nginx-ignition vulnerabilities

2 known vulnerabilities in nginx-ignition from Lucasdillmann. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  nginx-ignition: Allocation of Resources Without Limits or Throttling

  CVE-2026-61629Sep 21, 2026Lucasdillmann

  nginx ignition is a user interface for the nginx web server. In versions 2.29.0 through 2.40.0, the gin i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls `golang.org/x/text/language.ParseAcceptLanguage` on the raw `Ac

• 8.1 High severity

  nginx-ignition: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-61628Sep 21, 2026Lucasdillmann

  nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, `POST /api/users/onboarding/finish` is registered as anonymous (unauthenticated) and creates a user with full ReadWrite admin permissions. Because the handler uses a check-th