Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/lucasdillmann/nginx-ignition

3 known vulnerabilities (2 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
3 · 2 high, 1 medium
Registry
pkg.go.dev

Advisories 3

  • nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition

    Affected: fixed in 0.0.0-20260621194639-0586b4e55ab; all versions.

  • nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware

    Affected: from 0.0.0-20260126024607-cbaf0fc16ed8, fixed in 0.0.0-20260526022344-0c988fc1277c.

  • CVE-2026-61630Medium 4.2

    nginx ignition has TOTP Reuse During Validity Window

    Affected: from 0.0.0-20260217145239-1cbfae0296f1, fixed in 0.0.0-20260328015550-8d35e1eb5dd6.