criticalWeb serverpatchedCVSS 9.218 Oct 2026
NGINX
Three critical holes in software running a third of the web
What happened
Three memory-safety flaws in NGINX's HTTP/2 and upstream modules allow remote crashes and, in one configuration, code execution. Fixed releases are available for every supported branch.
Timeline
18 Oct 2026 · 10:30 UTC
Advisories
Three CVEs published with fixed branches.19 Oct 2026 · 06:00 UTC
Scanning
Internet-wide probes for the HTTP/2 crash begin.21 Oct 2026 · 16:00 UTC
Exploit
A working denial-of-service sequence is published.
Sources