Skip to content

CVE-2026-90439: fixed versions by distro

Every tracked distribution release and image, with the package version that counts as fixed and the vendor's own page.

Last checked 30 Oct 2026 04:12 UTCLast changed 30 Oct 2026 05:47 UTC

Overall: Partly fixed
Severity: Medium6.5CVSS v3.1Red Hat
Last checked: 30 Oct 2026 04:12 UTC

Check your version

Alpine Linux

2 of 2 fixed

Alpine Linux
Release	Package	Fixed version	State	Verified	Source
edge(development)	nginx	1.30.6-r0	Fixed	30 Oct 2026 04:12 UTC	Source
Alpine 3.24	nginx	1.30.6-r0	Fixed	30 Oct 2026 04:12 UTC	Source

Ubuntu

8 of 8 fixed

Ubuntu
Release	Package	Fixed version	State	Verified	Source
26.10(stonking)	nginx	No fixed version published yet	Not affectedVendor statement	30 Oct 2026 04:23 UTC	Source
14.04 LTS(trusty)	nginx	No fixed version published yet	Not affectedVendor statement	30 Oct 2026 04:23 UTC	Source
16.04 LTS(xenial)	nginx	No fixed version published yet	Not affectedVendor statement	30 Oct 2026 04:23 UTC	Source
24.04 LTS(noble)	nginx	No fixed version published yet	Not affectedVendor statement	30 Oct 2026 04:23 UTC	Source
18.04 LTS(bionic)	nginx	No fixed version published yet	Not affectedVendor statement	30 Oct 2026 04:23 UTC	Source
20.04 LTS(focal)	nginx	No fixed version published yet	Not affectedVendor statement	30 Oct 2026 04:23 UTC	Source
26.04 LTS(resolute)	nginx	No fixed version published yet	Not affectedVendor statement	30 Oct 2026 04:23 UTC	Source
22.04 LTS(jammy)	nginx	No fixed version published yet	Not affectedVendor statement	30 Oct 2026 04:23 UTC	Source

Debian

4 of 4 fixed

Debian
Release	Package	Fixed version	State	Verified	Source
forky(testing)	nginx	1.30.4-7	Fixed	30 Oct 2026 04:36 UTC	Source
sid(unstable)	nginx	1.30.4-7	Fixed	30 Oct 2026 04:36 UTC	Source
13(trixie) security	nginx	No fixed version published yet	Not affectedVendor statement	30 Oct 2026 04:36 UTC	Source
12(bookworm) security (LTS team)	nginx	No fixed version published yet	Not affectedVendor statement	30 Oct 2026 04:36 UTC	Source