Security digest: critical vulnerabilities in NGINX, Node.js, PostgreSQL and more

Several important security updates for widely used server software have been released over the past few weeks. Below is a short summary of what’s affected and what to do. If you don’t use a product, feel free to skip that item.

NGINX: three critical vulnerabilities (CVSS 9.2)

Flaws in the alias, rewrite and map directives, as well as in AIO and SSI, allow a remote attacker to crash worker processes and, in some cases, execute code. Affected: NGINX Open Source 1.30.5 and below and 1.31.6 and below, NGINX Plus R33–R37, Ingress Controller and other F5 NGINX products.

→ Update NGINX. If you can’t update right away: avoid alias inside location blocks, disable AIO and SSI, and use named captures in map.

eMudhra certificate authority: forged TLS certificates

The private keys of eight eMudhra intermediate certificates were trivially recoverable, making it possible to issue a trusted certificate for any domain. The certificates have been revoked, but servers still need to stop trusting them.

→ Update ca-certificates, as well as Python certifi (2026.10.19+), Go (1.27.3 / 1.26.10+), Node.js and Java. Rebuild Docker images, since they ship their own trust store.

Debian has also removed the Comodo AAA root in this update. If you see TLS errors after updating, this may be the cause.

Node.js: RCE via Brotli and 9 other CVEs

→ Update to 22.23.4, 24.22.1 or 26.12.1. Node 20 and 25 are end-of-life and will not receive fixes. Also update the system libbrotli library; this affects, for example, NGINX with the brotli module.

PostgreSQL: “PostGREShell” (CVE-2026-6471)

Remote code execution and privilege escalation via logical replication, affecting versions 9.4–18.

→ Current versions: 18.6, 17.11, 16.15, 15.19, 14.24. The November 12 release will be the last for PostgreSQL 14, so plan your upgrade.

Redis

Fixes include ACL bypasses, RCE via a malicious RDB file and an unauthenticated use-after-free in TLS.

→ Current versions: 8.10.2, 8.8.3, 8.6.7, 8.4.7, 8.2.10. Ports 6379 and 16379 should not be reachable from the internet.

Linux kernel: privilege escalation vulnerabilities

Copy Fail, Dirty Frag, Fragnesia, ssh-keysign-pwn and PinTheft allow a local user to gain root. This is especially relevant for servers where several users have shell access.

→ Update the kernel and reboot.

Next.js and sharp: RCE

→ Update Next.js to the latest 16.4.x or 15.5.28+, and sharp to 0.35.5+. Note that npm audit misses some of these advisories.

PHP: additional updates

In addition to the recent PHP2Shell fixes, an SQL injection in ext-pgsql has been fixed in 8.2.33, 8.3.33, 8.4.24 and 8.5.9. Please also update Composer (2.2.29 / 2.10.2) and Twig (3.26.0+). A possible new vulnerability in PHP 8.5.12 has been reported but not yet confirmed. We’re monitoring the situation.

Key leaks and supply chain attacks

• LiteLLM 1.107.0 contained malicious code that steals credentials. Check with pip show litellm and review your Docker image tags. If this version was installed, rotate every key and password the server had access to.
• Railway and OpenCode reported breaches that exposed customer keys. If you stored keys there, revoke them in the provider’s own dashboard (OpenAI, Anthropic, Google, cloud providers). Deleting the key from the affected service is not enough.
• General rule: don’t put sensitive data in domain names or subdomains. DNS queries are logged and kept in public archives for years.

What to do now

1. Update your system: apt update && apt upgrade (Debian/Ubuntu) or dnf update (AlmaLinux/Rocky), then reboot to load the new kernel.
2. Update separately installed software: NGINX, Node.js, databases and project dependencies.
3. Make sure Redis, PostgreSQL and other services aren’t exposed to the internet unless necessary.
4. Rebuild your Docker images.