Photon 5 nginx (1.28.3) vulnerable to CVE-2026-42945 — upstream patch only in 1.30.1+

[Yaminyam]

Summary

The nginx package in Photon 5 is pinned to 1.28.3 (SPECS/nginx/nginx.spec) and is affected by CVE-2026-42945 ("NGINX Rift"), a heap buffer overflow in ngx_http_rewrite_module that can lead to remote code execution from an unauthenticated HTTP request.

Reference: https://depthfirst.com/nginx-rift

Why Photon needs a bump (not a backport)

nginx CHANGES shows the upstream patch was published only in nginx 1.30.1 (2026-05-13) and 1.31.0. There is no 1.28.x backport — the 1.28.x stable line has had no further releases after the CVE disclosure. To pick up the fix, Photon 5 needs to move its stable branch from 1.28 to 1.30 (the project already did a similar bump from 1.26 → 1.28 in commit 3c9442255344 on 2026-03-31).

Impact

Photon 5's nginx package is consumed at least by:

• Harbor's goharbor/nginx-photon image (tdnf install -y nginx in make/photon/nginx/Dockerfile.base) — every Harbor v2.13.x / v2.14.x / v2.15.x release tested ships nginx 1.26.3 or 1.28.3, all vulnerable
• Any direct user of tdnf install nginx on Photon 5

Suggested fix

Bump SPECS/nginx/nginx.spec to nginx 1.30.1, update the source hash, and re-apply the existing convert-to-dynamic.patch (or rebase if it no longer applies cleanly). This also picks up the other CVEs published alongside Rift:

• CVE-2026-42926 (proxy_set_body data injection)
• CVE-2026-42946 (scgi/uwsgi buffer overread)
• CVE-2026-42934 (charset_map buffer overread)
• CVE-2026-40460 (HTTP/3 connection migration spoofing)
• CVE-2026-40701 (use-after-free in DNS / ssl_ocsp)

Happy to provide a draft nginx.spec patch if useful, though I'm aware the project uses an internal Gerrit for code review.

Reproduction

$ curl -s https://raw.githubusercontent.com/vmware/photon/5.0/SPECS/nginx/nginx.spec | grep '^Version:'
Version:        1.28.3

$ docker run --rm --entrypoint nginx goharbor/nginx-photon:v2.14.4 -v
nginx version: nginx/1.26.3   # (built against an older Photon snapshot)

cc: @Anish-Jain @ankit-aj-jain — looks like you handled the 1.26.3 → 1.28.3 bump previously.

[Yaminyam]

Update: looks like this is effectively resolved upstream.

The Photon 5 nginx.spec was bumped from 1.28.3 → 1.30.2 in commit 6bbc9f1a9c "91/92/nginx: Update to 1.30.2" on 2026-05-25, which is past 1.30.1 and so includes the CVE-2026-42945 ("NGINX Rift") fix together with the other CVEs disclosed alongside it (CVE-2026-42926, CVE-2026-42946, CVE-2026-42934, CVE-2026-40460, CVE-2026-40701).

$ curl -s https://raw.githubusercontent.com/vmware/photon/5.0/SPECS/nginx/nginx.spec | grep '^Version:'
Version:        1.30.2

For downstream consumers — Harbor in particular — goharbor/harbor#23248 and its release-2.15.0 cherry-pick #23250 switched goharbor/photon:5.0 to track the photon-snapshot repo, so the fix should land in goharbor/nginx-photon (and the other Photon-based Harbor images) as soon as v2.15.2 / v2.16.0 cut.

Happy to have this issue closed if a maintainer can confirm. Thanks for the quick turnaround on the spec bump.

[michellew-vmware]

A new PR for docker update of photon is published docker-library/official-images#21233.. Once it is merged.. please try it and see if the issue is gone.

Moreover, we only publish photon docker image of main subrelease (92 for now) for Photon OS in docker hub. So you can keep using photon-updates.repo for upgrading it.

Thanks,
Michelle

[bhllamoreaux]

nginx is fixed in 91/92 subrelease branches, so if you consume via 91/92 snapshot repos or alternatively from the photon-updates repo, you'll get the fixed version of nginx.

Also, just to confirm, I pulled the latest goharbor/photon image and it seems that the nginx 1.30.2 is available there via the snapshot repo.

[dcasota]

Hi @bhllamoreaux, would you mind to review and accept #1663, #1664, #1665, #1666 ? please, give credits to @Mosherfist I've you are happy with the quality. Btw. goharbor/photon, goharbor/nginx-photon, goharbor/registry-photon, etc. seem to have a drift. Could you please double check the statement "goharbor/photon image and it seems that the nginx 1.30.2 is available there via the snapshot repo"? They are still using the vulnerable version, right?

[bhllamoreaux]

Hi @dcasota,

would you mind to review and accept #1663, #1664, #1665, #1666 ?

Since it's already fixed in Photon 5.0-91, and 5.0-92, I hope that consuming the RPM from those branches is acceptable. Older release branches like 4.0 and 5.0-90 have a higher bar to get CVE fixes in at this point. Please let me know if it is really needed there.

Also for reference, main/master and 5.0-9.1.1 are not valid development branches. All PRs should go in 5.0 and/or 4.0 only.

Btw. goharbor/photon, goharbor/nginx-photon, goharbor/registry-photon, etc. seem to have a drift. Could you please double check the statement "goharbor/photon image and it seems that the nginx 1.30.2 is available there via the snapshot repo"?

Seems like this GHSA link is broken... But I just pulled the latest goharbor/photon:5.0 and I see 1.30.4-2.ph5 available via the snapshot repo. So it looks fine to me?

root@photon-blam [ ~/gerrit/photon-5.0 ]# docker pull goharbor/photon:5.0
5.0: Pulling from goharbor/photon
f32f037feefe: Already exists 
daec2471d150: Pull complete 
Digest: sha256:ece530370eeb224becba383ccd08f8dcea96b1b2d2781f7519386f81cd52f0f4
Status: Downloaded newer image for goharbor/photon:5.0
docker.io/goharbor/photon:5.0
root@photon-blam [ ~/gerrit/photon-5.0 ]# docker run -it --network=host goharbor/photon:5.0 /bin/bash 
root [ / ]# tdnf list nginx
Refreshing metadata for: 'VMware Photon Linux 5.0 (x86_64) Snapshot for Updates'
photon-snapshot                           3591 100%
photon-snapshot (primary)              4836663 100%
photon-snapshot (update info)           103152 100%
photon-snapshot (other)                2412283 100%
photon-snapshot                          50538 100%
nginx.x86_64                                                                      1:1.30.4-2.ph5                               photon-snapshot

In general, regarding goharbor images, I have no special information. This project is a downstream consumer of Photon, we have no involvement with them, so if there is an issue with consumption please raise it to them. The RPM in this case is available on our side, so up to them to consume it properly.

[dcasota]

Hi Brennan,
Thank you for the clarification. and reviewing the situation. Yes, goharbor/photon is fine, the different consumer goharbor/nginx-photon still uses the old version. My main argument is that continuously shipping CIS-, FIPS-, and STIG-compliant images by default, with provenance generateable from any branch, improves consumer perception because Docker Hub and other registries report far fewer false positives. Github itself could soon go a step further and considering generic, AI-powered reportings of all branches of a project and signalizing the "safety level". The result remains a sort of unecessary negative visibility for a long time.
Scaling AI-powered contributions from developers like @Yaminyam and @Mosherfist is a topic in many projects, I guess.
(Re-)thinking,
Daniel