Photon 5 nginx (1.28.3) vulnerable to CVE-2026-42945 — upstream patch only in 1.30.1+

[Yaminyam]

Summary

The nginx package in Photon 5 is pinned to 1.28.3 (SPECS/nginx/nginx.spec) and is affected by CVE-2026-42945 ("NGINX Rift"), a heap buffer overflow in ngx_http_rewrite_module that can lead to remote code execution from an unauthenticated HTTP request.

Reference: https://depthfirst.com/nginx-rift

Why Photon needs a bump (not a backport)

nginx CHANGES shows the upstream patch was published only in nginx 1.30.1 (2026-05-13) and 1.31.0. There is no 1.28.x backport — the 1.28.x stable line has had no further releases after the CVE disclosure. To pick up the fix, Photon 5 needs to move its stable branch from 1.28 to 1.30 (the project already did a similar bump from 1.26 → 1.28 in commit 3c9442255344 on 2026-03-31).

Impact

Photon 5's nginx package is consumed at least by:

• Harbor's goharbor/nginx-photon image (tdnf install -y nginx in make/photon/nginx/Dockerfile.base) — every Harbor v2.13.x / v2.14.x / v2.15.x release tested ships nginx 1.26.3 or 1.28.3, all vulnerable
• Any direct user of tdnf install nginx on Photon 5

Suggested fix

Bump SPECS/nginx/nginx.spec to nginx 1.30.1, update the source hash, and re-apply the existing convert-to-dynamic.patch (or rebase if it no longer applies cleanly). This also picks up the other CVEs published alongside Rift:

• CVE-2026-42926 (proxy_set_body data injection)
• CVE-2026-42946 (scgi/uwsgi buffer overread)
• CVE-2026-42934 (charset_map buffer overread)
• CVE-2026-40460 (HTTP/3 connection migration spoofing)
• CVE-2026-40701 (use-after-free in DNS / ssl_ocsp)

Happy to provide a draft nginx.spec patch if useful, though I'm aware the project uses an internal Gerrit for code review.

Reproduction

$ curl -s https://raw.githubusercontent.com/vmware/photon/5.0/SPECS/nginx/nginx.spec | grep '^Version:'
Version:        1.28.3

$ docker run --rm --entrypoint nginx goharbor/nginx-photon:v2.14.4 -v
nginx version: nginx/1.26.3   # (built against an older Photon snapshot)

cc: @Anish-Jain @ankit-aj-jain — looks like you handled the 1.26.3 → 1.28.3 bump previously.

[Yaminyam]

Update: looks like this is effectively resolved upstream.

The Photon 5 nginx.spec was bumped from 1.28.3 → 1.30.2 in commit 6bbc9f1a9c "91/92/nginx: Update to 1.30.2" on 2026-05-25, which is past 1.30.1 and so includes the CVE-2026-42945 ("NGINX Rift") fix together with the other CVEs disclosed alongside it (CVE-2026-42926, CVE-2026-42946, CVE-2026-42934, CVE-2026-40460, CVE-2026-40701).

$ curl -s https://raw.githubusercontent.com/vmware/photon/5.0/SPECS/nginx/nginx.spec | grep '^Version:'
Version:        1.30.2

For downstream consumers — Harbor in particular — goharbor/harbor#23248 and its release-2.15.0 cherry-pick #23250 switched goharbor/photon:5.0 to track the photon-snapshot repo, so the fix should land in goharbor/nginx-photon (and the other Photon-based Harbor images) as soon as v2.15.2 / v2.16.0 cut.

Happy to have this issue closed if a maintainer can confirm. Thanks for the quick turnaround on the spec bump.

[michellew-vmware]

A new PR for docker update of photon is published docker-library/official-images#21233.. Once it is merged.. please try it and see if the issue is gone.

Moreover, we only publish photon docker image of main subrelease (92 for now) for Photon OS in docker hub. So you can keep using photon-updates.repo for upgrading it.

Thanks,
Michelle

[bhllamoreaux]

nginx is fixed in 91/92 subrelease branches, so if you consume via 91/92 snapshot repos or alternatively from the photon-updates repo, you'll get the fixed version of nginx.

Also, just to confirm, I pulled the latest goharbor/photon image and it seems that the nginx 1.30.2 is available there via the snapshot repo.