Who should care
Anyone who runs nginx as a web server or reverse proxy that uses the resolver feature, and anyone who pays a provider to run it. If you are not sure, ask your hosting provider which nginx version your site uses.
What to do
- Find out which nginx version your site runs. Ask your web developer or hosting provider if you are not sure.
- Compare it with the affected versions above and with the vendor's advisory for CVE-2021-23017.
- Apply updates per vendor instructions, as the CISA catalogue sample says.
- Run the exposure check on this page again once you have updated.
What is affected
nginx from 0.6.18 up to, but not including, 1.20.1, and nginx 1.21.0, as recorded in our offline NVD sample. Confirm the affected and fixed versions in the vendor's advisory.
Is it being exploited?
- CISA KEV
- Listed in the CISA Known Exploited Vulnerabilities (KEV) catalogue, which means CISA has evidence it has been exploited. It was added on 20 May 2024. CISA's due date for United States federal agencies to act was 10 June 2024.
- EPSS
- Low: 0.012, percentile 0.79, as at 1 June 2024. EPSS is a probability from 0 to 1, published by FIRST, that exploitation activity is seen in the next 30 days. It describes the vulnerability in general, not your business.
Severity and technical details
- CVSS score
- 7.7 out of 10, high (CVSS version 3.1)
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L- Weakness (CWE)
- Affected version ranges
- f5 nginx from 0.6.18 up to (excluding) 1.20.1
- openresty up to (excluding) 1.19.3.2
- fedoraproject fedora 33
- fedoraproject fedora 34
- netapp ontap select deploy administration utility
- oracle blockchain platform up to (excluding) 21.1.2
- oracle communications control plane monitor 3.4
- oracle communications control plane monitor 4.2
- Published in the NVD
- 1 June 2021
- Last changed in the NVD
- 17 June 2026
- Severity, weakness and dates from
- NIST National Vulnerability Database (NVD)