lucasdillmann/nginx-ignition Security Advisories | GitStock

high2026-09-21

nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition

GHSA-pxcx-fv34-x9p5 · CVE-2026-61628

high2026-09-21

nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware

GHSA-jr34-h97m-9hpx · CVE-2026-61629

medium2026-09-21

nginx ignition has TOTP Reuse During Validity Window

GHSA-hf33-q6cf-c66f · CVE-2026-61630