NGINX contains several security vulnerabilities, notably a use-after-free flaw in the ngx_http_rewrite_module that may allow remote attackers to crash the server or execute arbitrary code (CVE-2026-9256). Additional issues include improper validation in the HTTP/3 QUIC module, use-after-free in the ngx_http_ssl_module during client certificate verification, and improper handling of proxied responses in the ngx_http_charset_module. These vulnerabilities can lead to denial of service, information disclosure, or bypass of authorization and rate limiting. The issues affect multiple Ubuntu LTS releases and related NGINX packages. Vendor advisories from Ubuntu provide fixed package versions and recommend standard system updates or Ubuntu Pro for remediation.

The vulnerabilities can be exploited remotely to cause denial of service by crashing NGINX or potentially allow arbitrary code execution, which could compromise the server. Other issues may lead to information disclosure or bypass of authorization and rate limiting mechanisms. The impact varies by vulnerability but includes service disruption and possible unauthorized access or data modification.

Fixes for these vulnerabilities are available and can be applied via standard system updates on affected Ubuntu releases. Ubuntu Pro provides extended security coverage and fixes for older LTS versions. Users should update to the fixed package versions listed in the Ubuntu security advisories USN-8354-1 and USN-8375-1. No additional mitigation beyond applying these updates is indicated by the vendor advisories.