NGINX before 1.13.6 has a buffer overflow for years that exceed four digits, as demonstrated by a file with a modification date in 1969…

Description

NGINX before 1.13.6 has a buffer overflow for years that exceed four digits, as demonstrated by a file with a modification date in 1969 that causes an integer overflow (or a false modification date far in the future), when encountered by the autoindex module.

Scores

EPSS (exploitation in 30 days)

3.3% · top 12% of all CVEs (2 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: yes · Technical impact: total

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.

Weakness

• n/a
• CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (opens in a new tab)
• CWE-190 Integer Overflow or Wraparound (opens in a new tab)

Affected products

• n/a

  • affected n/a

References (6)

• http://nginx.org/en/CHANGES (opens in a new tab)x_refsource_MISCx_transferred
• https://trac.nginx.org/nginx/ticket/1368 (opens in a new tab)x_refsource_MISCx_transferred
• https://github.com/nginx/nginx/commit/0206ebe76f748bb39d9de4dd4b3fce777fdfdccf (opens in a new tab)x_refsource_MISCx_transferred
• https://github.com/nginx/nginx/commit/b900cc28fcbb4cf5a32ab62f80b59292e1c85b4b (opens in a new tab)x_refsource_MISCx_transferred
• [debian-lts-announce] 20210607 [SECURITY] [DLA 2680-1] nginx security update (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• https://security.netapp.com/advisory/ntap-20210805-0006/ (opens in a new tab)x_refsource_CONFIRMx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Record last updated 5 Dec 2025, 14:54 UTC.