Skip to content

chore(deps): bump nginxinc/nginx-unprivileged from 1.29.5-alpine to 1.31.0-alpine in /frontend #108

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
dependabot wants to merge 1 commit into from
+1 −1
Closed

chore(deps): bump nginxinc/nginx-unprivileged from 1.29.5-alpine to 1.31.0-alpine in /frontend #108

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion frontend/Dockerfile.prod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ RUN npm ci
COPY . /app
RUN npm run build

FROM nginxinc/nginx-unprivileged:1.29.5-alpine@sha256:a731ba0194833ae0f80994a4ae08988aa95fdcc88f4f991340ce160770cf2b6d
FROM nginxinc/nginx-unprivileged:1.31.0-alpine@sha256:4c18337659c90a01627f2e152b7c89524521c82dcedb255dc83d3689642b0803

@coderabbitai coderabbitai Bot May 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Description: Verify the nginx-unprivileged:1.31.0-alpine image digest

# Fetch the actual digest from Docker Hub
echo "Fetching digest for nginxinc/nginx-unprivileged:1.31.0-alpine..."
curl -s "https://hub.docker.com/v2/repositories/nginxinc/nginx-unprivileged/tags/1.31.0-alpine" | jq -r '.digest // .images[]?.digest' | head -1

echo ""
echo "Expected digest in Dockerfile:"
echo "sha256:4c18337659c90a01627f2e152b7c89524521c82dcedb255dc83d3689642b0803"

Repository: HYOSUNG-ITX-AI-Business-Department/pg-erd-cloud

Length of output: 332

🌐 Web query:

nginx CVE-2026-42945 buffer overflow rewrite module

💡 Result:

CVE-2026-42945, also known as NGINX Rift, is a critical heap-based buffer overflow vulnerability in the ngx_http_rewrite_module of NGINX Open Source and NGINX Plus [1][2][3]. The vulnerability has existed in the codebase since 2008 [4][3][5]. Vulnerability Details: The flaw is triggered when a rewrite directive is followed by another rewrite, if, or set directive, and uses an unnamed Perl-Compatible Regular Expression (PCRE) capture (e.g., $1, $2) in a replacement string that includes a question mark (?) [1][2][6]. An unauthenticated attacker can exploit this by sending crafted HTTP requests to trigger a heap buffer overflow in the NGINX worker process [1][7]. This typically results in a worker process crash and restart, leading to a denial-of-service (DoS) condition [1][8][4]. On systems where Address Space Layout Randomization (ASLR) is disabled, the vulnerability may allow for remote code execution (RCE) [1][7][4]. Affected Versions: - NGINX Open Source: Versions 0.6.27 through 1.30.0 [2][3]. - NGINX Plus: Affected versions include R32 P4.0 and earlier, and other versions prior to the patches [9]. Remediation: - Patching: Upgrade to fixed versions immediately [6][3]. - NGINX Open Source: Upgrade to 1.30.1, 1.31.0, or later [2][6][3]. - NGINX Plus: Upgrade to R32 P6, R36 P4, 37.0.0, or later [8][6][3]. - Configuration Mitigation: If patching is not immediately possible, replace all unnamed PCRE captures (e.g., $1, $2) with named captures in affected rewrite directives to eliminate the trigger condition [2][7][6][3]. - Post-Patching: Restart NGINX worker processes after applying updates to ensure the patched binary is loaded [2][6].

Citations:

🌐 Web query:

nginx 1.31.0 security vulnerabilities fixes

💡 Result:

NGINX 1.31.0 is a mainline version released on May 13, 2026, which includes critical security fixes for several vulnerabilities [1][2][3]. The following security vulnerabilities are addressed in NGINX 1.31.0: - CVE-2026-42926: Fixes an HTTP/2 request injection vulnerability in the ngx_http_proxy_module that could occur when using the proxy_set_body directive [1][3]. - CVE-2026-42945: Fixes a heap memory buffer overflow in the ngx_http_rewrite_module, which could potentially lead to arbitrary code execution [1][3][4]. This vulnerability has been widely reported as a long-standing issue (sometimes referred to as NGINX Rift) [5][6][7]. - CVE-2026-42946: Fixes buffer overread vulnerabilities in the ngx_http_scgi_module and ngx_http_uwsgi_module [1][2]. - CVE-2026-42934: Fixes a buffer overread vulnerability in the ngx_http_charset_module [1][2]. - CVE-2026-40460: Fixes an address spoofing vulnerability in HTTP/3 [1][2]. - CVE-2026-40701: Fixes a use-after-free vulnerability in OCSP requests to the resolver [1][3]. Users are advised to upgrade to NGINX 1.31.0 (or the stable version 1.30.1, which also contains these fixes) to mitigate these risks [8][9][7]. For those unable to upgrade immediately, a temporary mitigation for CVE-2026-42945 involves replacing unnamed regular expression captures with named captures in affected rewrite directives [4][7].

Citations:

🔍 Additional research query:

Search for nginx official security advisories about CVE-2026-42945 and related vulnerabilities

💡 Result:

Excellent search results found! I now have comprehensive information about CVE-2026-42945 and related NGINX vulnerabilities from official sources and security advisories. Let me compile this information.

Official NGINX Security Advisories for CVE-2026-42945 and Related Vulnerabilities

CVE-2026-42945 (NGINX Rift) - Critical Heap Buffer Overflow

CVE-2026-42945 is a buffer overflow in the ngx_http_rewrite_module with medium severity, affecting versions 0.6.27-1.30.0, and fixed in versions 1.31.0+ and 1.30.1+.

Vulnerability Details:

  • A critical vulnerability (CVE-2026-42945, CVSS 9.2) was disclosed affecting NGINX Open Source and NGINX Plus, allowing attackers to reliably trigger denial-of-service (DoS) conditions and potentially achieve remote code execution (RCE) via specially crafted HTTP requests.
  • The issue originates from the ngx_http_rewrite_module, where improper handling of unnamed PCRE captures combined with rewrite directives and replacement strings containing a question mark (?) leads to a heap buffer overflow in the NGINX worker process.

Discovery & Disclosure Timeline:

  • The issue was responsibly disclosed on April 21, 2026, and F5 confirmed, patched, and published the coordinated advisory on May 13, 2026.

Affected Versions & Products:

  • The following components are affected: NGINX Open Source versions 1.0.0 through 1.30.0, NGINX Plus R32 through R36, as well as several dependent products including NGINX Ingress Controller, NGINX Gateway Fabric, NGINX App Protect WAF, F5 WAF for NGINX, and related DoS protection offerings.

Exploitation Requirements:

  • The vulnerability is particularly dangerous in deployments utilizing rewrite, if, or set directives with unnamed regex captures such as $1 or $2.

Remediation:

  • Users should upgrade to NGINX Open Source 1.30.1 or 1.31.0 and NGINX Plus R32 P6 or R36 P4.
  • If immediate patching is not possible, organizations should replace unnamed captures with named captures in affected rewrite directives as a temporary mitigation.

Related Vulnerabilities Patched in the Same Release:

Three further vulnerabilities were patched in the same release. CVE-2026-42946, rated CVSS 8.3, addresses a memory allocation flaw in the SCGI and UWSGI proxy modules. CVE-2026-40701 (CVSS 6.3) covers a use-after-free in the SSL module. CVE-2026-42934 (CVSS 6.3) resolves an out-of-bounds read in the charset module.

Related CVEs from Official NGINX Advisory:

  • CVE-2026-42946: Buffer overread in the ngx_http_scgi_module and ngx_http_uwsgi_module with medium severity
  • CVE-2026-42934: Buffer overread in the ngx_http_charset_module with low severity
  • CVE-2026-40460: HTTP/3 address spoofing with medium severity
  • CVE-2026-40701: resolver use-after-free in OCSP with medium severity

Source: [nginx.org/en/security_advisories.html]

Key Risk Factors:

At the time of writing, a public GitHub proof-of-concept (PoC) exploit has already been released, significantly increasing the likelihood of opportunistic exploitation attempts and rapid weaponization by threat actors.

CVE-2026-42945 vulnerability stands out as an 18-year-old heap buffer overflow in ngx_http_rewrite_module that can be reached by an unauthenticated attacker through crafted HTTP requests and may lead to denial of service or, in some cases, remote code execution.

이미지 다이제스트 검증 완료 및 중요 보안 업데이트 확인

nginx-unprivileged 1.31.0-alpine으로의 업그레이드는 6개의 중요 보안 취약점을 해결합니다:

현재 버전 1.29.5는 위 모든 취약점에 노출되어 있으므로 이 업데이트는 높은 우선순위입니다.

참고사항:

  1. 이미지 다이제스트 검증 완료: sha256:4c18337659c90a01627f2e152b7c89524521c82dcedb255dc83d3689642b0803 ✓
  2. nginx 1.31.x는 메인라인 버전입니다(안정 버전 1.30.1도 동일한 패치 포함).
  3. nginx 1.30.0+부터 업스트림 keepalive 연결 기본값이 변경되었으므로, 기존 nginx.conf 설정과의 호환성 테스트를 권장합니다.
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@frontend/Dockerfile.prod` at line 10, 기본 베이스 이미지를 업그레이드해야 합니다: Dockerfile의
FROM nginxinc/nginx-unprivileged reference를 현재 취약한 태그에서
nginxinc/nginx-unprivileged:1.31.0-alpine@sha256:4c18337659c90a01627f2e152b7c89524521c82dcedb255dc83d3689642b0803으로
교체하고 이미지 다이제스트가 일치하는지 검증하세요; 변경 후 nginx.conf와 관련된 동작(특히 keepalive 연결 기본값 변경으로 인한
호환성)을 테스트하고 필요하면 설정(keepalive, proxy/HTTP2/HTTP3 관련 블록 등)을 조정해 배포 전에 회귀를 방지하세요.


COPY --from=build /app/dist /usr/share/nginx/html
COPY nginx.conf /etc/nginx/conf.d/default.conf
Expand Down
Loading