Repository navigation
[BUG] CVE-2026-42055. When will there be 1.30.3+ or 1.31.2+ part of this image? #616
Description
Is there an existing issue for this?
- I have searched the existing issues
Current Behavior
Current swag images have nginx releases 1.28.x included which are effected by CVE-2026-42055. It takes at least nginx 1.30.3+ or 1.31.2+ to fix the issue.
Expected Behavior
swag images are being updated with nginx versions fixing CVE-2026-42055.
Steps To Reproduce
- Create swag container
- Execute
nginx -vinside container
Environment
CPU architecture
x86-64
Docker creation
image: lscr.io/linuxserver/swag:latestContainer logs
nginx version: nginx/1.28.3
Activity
github-actions commentedon Jun 18, 2026
Thanks for opening your first issue here! Be sure to follow the relevant issue templates, or risk having this issue marked as invalid.
aptalca commentedon Jun 18, 2026
It's up to alpine, and they usually patch rather than update
godfuture commentedon Jun 18, 2026
I dont understand what release is being installed in underlying alpine nginx image:
https://github.com/linuxserver/docker-baseimage-alpine-nginx/blob/3.22/Dockerfile#L15
It notes only
nginx. Why the release version is missing? Or is determined by baseimage-alpine:3.22?Roxedus commentedon Jun 18, 2026
Latter.
thespad commentedon Jun 18, 2026
Alpine will not make a major version change to nginx within an existing release, they will backport the security fix to 1.28 and when they do it will trigger a new build of the base image, which will then trigger a new build of the swag image.
j0nnymoe commentedon Jun 18, 2026
As a side note, you can see the versions for everything in the container here: https://github.com/linuxserver/docker-swag/blob/master/package_versions.txt
C0nw0nk commentedon Jun 20, 2026
defaults nginx config values make swag nginx not vulnerable to this unless you have put those nginx config values in place.
You can test via https://www.ssllabs.com/ssltest/analyze.html?d=linuxserver.io&s=178.62.84.203
The test will check if your domain is exposed to certain CVE exploits HTTP3/QUIC etc.
C0nw0nk commentedon Jun 20, 2026
Also inline with other info you can check.
https://thehackernews.com/2026/06/f5-patches-two-critical-nginx-open.html
Theres a few good sources on this but it should be expressed that by default
ignore_invalid_headers on;is on and this really does impact only those running custom nginx configurations where they are not using default/recommended values.I did add my own security in the way of a WAF and Anti-DDoS script to SWAG that anyone wants to checkout.
https://github.com/C0nw0nk/Nginx-Lua-Anti-DDoS/wiki/Linuxserver-Docker-SWAG-usage
h9419 commentedon Jul 22, 2026
CVE-2026-42533 also affects current swag images
For the time being, I have to exec into a running swag container, edit
/etc/apk/repositoriesto alpine version 3.24,apk update,apk upgradethen restart the container to have a version of Nginx without known critical CVEs.thespad commentedon Jul 22, 2026
a) The fix was backported less than 48 hours ago, the package checks will pick it up and build it in short order
b) Are you running on a host with ASLR disabled? If not then you're not affected by that vulnerability. If so then why on earth would you do that it's 2026?
C0nw0nk commentedon Jul 22, 2026
The issue is related to
CVE-2026-42055as the title shows.You have quoted
CVE-2026-42533what is a different CVE perhaps open a new issue / report for this ?LinuxServer-CI commentedon Aug 21, 2026
This issue has been automatically marked as stale because it has not had recent activity. This might be due to missing feedback from OP. It will be closed if no further activity occurs. Thank you for your contributions.