Ubuntu USN-8955-2 brings nginx fixes to older LTS releases
Ubuntu USN-8955-2 delivers the nginx fixes to older LTS releases. See who is affected, how to check one server and how to confirm the update.
TL;DR: Ubuntu USN-8955-2 brings the nginx fixes from USN-8955-1 to four older long-term-support releases and adds a fix for CVE-2026-42533. A remote attacker could crash nginx or possibly run code, so update the package.
What happened
Ubuntu Security Notices published USN-8955-2 on November 5, 2026. The earlier notice, USN-8955-1, covered newer releases. This one carries the corresponding update to Ubuntu 20.04, 18.04, 16.04 and 14.04 LTS.
The notice says nginx mishandled several configurations: map directives that use regular expressions, and an alias directive combined with rewrite rules. A remote attacker could use them to crash the web server, and the notice says code execution is possible. CVE-2026-42533 is the one newly fixed here, and CVE-2026-15176 is one of the others. The National Vulnerability Database entries describe the code execution case as depending on conditions outside the attacker's control, such as address space randomisation being off or bypassed.
Am I affected?
You are affected if a server on one of those Ubuntu releases runs the nginx package from Ubuntu and has not applied the update. Run nginx -v and apt list --installed 2>/dev/null | grep -i nginx, then compare with the fixed version on the Ubuntu page. Configurations that use map with regular expressions or alias with rewrite are the ones the notice describes. nginx inside a container image or built from source is not changed by the Ubuntu package, so check those separately.
How to check with Stackurity
Stackurity reads installed packages on Ubuntu servers and matches them against vendor advisories every hour, with distribution backports taken into account, so one inventory shows every server still running the old nginx. Software built from source or copied into an application outside a package manager is not covered. After you update, check again asks the agent for a fresh report and records whether the issue is gone. See how Stackurity handles fixes. Stackurity Cloud has a 14-day free trial without a card: Start a free trial.
