DockerState

Home › Web servers and proxies › nginx › 1.30

nginx:1.30

The nginx web server and reverse proxy, tag 1.30, built on Debian 13.7 (trixie). Pushed to Docker Hub yesterday.

Critical 1High 58Medium 108Low 166Unknown 9Starts as root8 platforms

64 MBdownload (compressed)
166 MBunpacked on disk
7filesystem layers
151packages
3,676files
docker pull nginx:1.30nginx@sha256:66b50d24288dba67f3d000b31223daefc4868c58d29aaacb6a4ff9771597b5eb

Size per platform

Compressed download size on Docker Hub for each architecture.

  • ppc64le68 MB
  • i38664 MB
  • amd6464 MB
  • arm6462 MB
  • s390x61 MB
  • riscv6458 MB
  • arm/v555 MB
  • arm/v753 MB

Where the bytes go

Unpacked bytes by directory in the final amd64 filesystem.

  • /usr/lib/x86_64-linux-gnu92 MB
  • /usr/bin26 MB
  • /usr/lib/nginx18 MB
  • /usr/sbin8.3 MB
  • /var/lib3.8 MB
  • /usr/share/fonts3.4 MB
  • /usr/share/doc2.0 MB
  • /var/cache1.8 MB
  • /usr/share/X111.2 MB
  • /usr/lib/apt1.1 MB

Layers

The 7 filesystem layers of the amd64 image, in build order, with each layer's compressed size and the build step that made it.

Full build steps
  1. 30 MB# debian.sh --arch 'amd64' out/ 'trixie' '@1793059200'
  2. 34 MBRUN /bin/sh -c set -x && groupadd --system --gid 101 nginx && useradd --system --gid nginx --no-create-home --home /nonexistent --comment "nginx user" --shell /bin/false --uid 101 nginx && apt-get update && apt-get install --no-install-recommends --no-install-suggests -y gnupg1 ca-certificates && NGINX_GPGKEYS="573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62 8540A6F18833A80E9C1653A42FD21310B49F6B46 9E9BE90EACBCDE69FE9B204CBCDCD8A38D88A2B3"; NGINX_GPGKEY_PATH=/etc/apt/keyrings/nginx-archive-keyring.gpg; export GNUPGHOME="$(mktemp -d)"; found=''; for NGINX_GPGKEY
  3. 629 BCOPY docker-entrypoint.sh / # buildkit
  4. 964 BCOPY 10-listen-on-ipv6-by-default.sh /docker-entrypoint.d # buildkit
  5. 404 BCOPY 15-local-resolvers.envsh /docker-entrypoint.d # buildkit
  6. 1 kBCOPY 20-envsubst-on-templates.sh /docker-entrypoint.d # buildkit
  7. 1 kBCOPY 30-tune-worker-processes.sh /docker-entrypoint.d # buildkit

Known vulnerabilities

1Critical0 with a fix
58High0 with a fix
108Medium0 with a fix
166Low0 with a fix
9Unknown0 with a fix

342 findings across 151 packages; 0 have a fixed version upstream, so rebuilding or updating packages clears them. The rest have no fix released yet; distributions often mark these “will not fix” or “deferred” for issues that do not affect the packaged build.

SeverityVulnerabilityAffected packagesFixed in
Critical CVE-2026-6653libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free libxml2installed 2.12.7+dfsg+really2.9.14-2.1+deb13u3 no fix yet
High CVE-2025-69720ncurses: ncurses: Buffer overflow vulnerability may lead to arbitrary code execution. libtinfo6, ncurses-base, ncurses-bininstalled 6.5+20250216-2 no fix yet
High CVE-2026-12064curl: curl: SSH host verification bypass when using schemeless URLs with SFTP/SCP curl, libcurl4t64installed 8.14.1-2+deb13u7 no fix yet
High CVE-2026-16742systemd: systemd-homed: Local privilege escalation via missing home-record signature verification libsystemd0, libudev1installed 257.13-1~deb13u1 no fix yet
High CVE-2026-36849[Denial of Service via large SamplesPerPixel tag] libtiff6installed 4.7.0-3+deb13u3 no fix yet
High CVE-2026-52490libtiff: libtiff: Arbitrary code execution via process_command_opts() function libtiff6installed 4.7.0-3+deb13u3 no fix yet
High CVE-2026-54369acl: Symlink traversal privilege escalation via libacl functions libacl1installed 2.3.2-2+b1 no fix yet
High CVE-2026-74860libxml2: double-free/UAF in libxml2 Python bindings libxml2installed 2.12.7+dfsg+really2.9.14-2.1+deb13u3 no fix yet
High CVE-2026-76642util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks bsdutils, libblkid1, liblastlog2-2, libmount1 +5 moreinstalled 1:2.41.5-0+deb13u1 no fix yet
High CVE-2026-78408util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority bsdutils, libblkid1, liblastlog2-2, libmount1 +5 moreinstalled 1:2.41.5-0+deb13u1 no fix yet
High CVE-2026-78409util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks bsdutils, libblkid1, liblastlog2-2, libmount1 +5 moreinstalled 1:2.41.5-0+deb13u1 no fix yet
High CVE-2026-78410util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection bsdutils, libblkid1, liblastlog2-2, libmount1 +5 moreinstalled 1:2.41.5-0+deb13u1 no fix yet
High CVE-2026-8458curl: libcurl: Unauthorized connection reuse due to a logical error curl, libcurl4t64installed 8.14.1-2+deb13u7 no fix yet
High CVE-2026-86138libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow libxml2installed 2.12.7+dfsg+really2.9.14-2.1+deb13u3 no fix yet
High CVE-2026-86139libxml2: libxml2: Integer overflow in xmlURIEscapeStr may lead to arbitrary code execution libxml2installed 2.12.7+dfsg+really2.9.14-2.1+deb13u3 no fix yet
High CVE-2026-86140libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements libxml2installed 2.12.7+dfsg+really2.9.14-2.1+deb13u3 no fix yet
High CVE-2026-86142libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation libxml2installed 2.12.7+dfsg+really2.9.14-2.1+deb13u3 no fix yet
High CVE-2026-86143libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks libxml2installed 2.12.7+dfsg+really2.9.14-2.1+deb13u3 no fix yet
High CVE-2026-86144libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation. libxml2installed 2.12.7+dfsg+really2.9.14-2.1+deb13u3 no fix yet
High CVE-2026-88806libX11: libX11: Heap-based buffer overflow via malicious X server libx11-6, libx11-datainstalled 2:1.8.12-1 no fix yet
High CVE-2026-9538perl-Archive-Tar: perl-Archive-Tar: Denial of Service via crafted tar header with large entry size perl-baseinstalled 5.40.1-6+deb13u1 no fix yet
Medium CVE-2025-10911libxslt: use-after-free with key data stored cross-RVT libxslt1.1installed 1.1.35-1.2+deb13u3 no fix yet
Medium CVE-2025-66382libexpat: libexpat: Denial of service via crafted file processing libexpat1installed 2.9.0-1~deb13u1 no fix yet
Medium CVE-2026-102010gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap erase_if gcc-14-base, libgcc-s1, libgomp1, libstdc++6installed 14.2.0-19 no fix yet
Medium CVE-2026-10536libcurl: libcurl: Use-after-free vulnerability leading to Denial of Service curl, libcurl4t64installed 8.14.1-2+deb13u7 no fix yet
Medium CVE-2026-107161cyrus-sasl: Heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise DIGEST-MD5 clients libsasl2-2, libsasl2-modules-dbinstalled 2.1.28+dfsg1-9 no fix yet
Medium CVE-2026-107708krb5: krb5: Denial of Service via malformed PAC in S4U2Proxy requests libgssapi-krb5-2, libk5crypto3, libkrb5-3, libkrb5support0installed 1.21.3-5+deb13u1 no fix yet
Medium CVE-2026-107778krb5: krb5: Denial of Service via crafted forwarded credentials libgssapi-krb5-2, libk5crypto3, libkrb5-3, libkrb5support0installed 1.21.3-5+deb13u1 no fix yet
Medium CVE-2026-113351expat: expat: Denial of Service via improper memory tracking in XML_ParserReset libexpat1installed 2.9.0-1~deb13u1 no fix yet
Medium CVE-2026-11856curl: curl: Information disclosure via incorrect Digest authentication header reuse curl, libcurl4t64installed 8.14.1-2+deb13u7 no fix yet
Medium CVE-2026-13757p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing libp11-kit0installed 0.25.5-3 no fix yet
Medium CVE-2026-15059systemd: systemd-oomd: Unprivileged users can terminate arbitrary processes via IPC API libsystemd0, libudev1installed 257.13-1~deb13u1 no fix yet
Medium CVE-2026-15534perl: Perl: Arbitrary code execution via out-of-bounds memory access in regular expression engine. perl-baseinstalled 5.40.1-6+deb13u1 no fix yet
Medium CVE-2026-18374glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string libc-bin, libc6installed 2.41-12+deb13u4 no fix yet
Medium CVE-2026-18477tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape tarinstalled 1.35+dfsg-3.1 no fix yet
Medium CVE-2026-18495libtiff: libtiff: heap-buffer overflow via numeric truncation in the JPEG raw passthrough libtiff6installed 4.7.0-3+deb13u3 no fix yet
Medium CVE-2026-18508tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite tarinstalled 1.35+dfsg-3.1 no fix yet
Medium CVE-2026-18938p11-kit: Integer overflow in RPC attribute-array length calculation can under-allocate nested attribute storage on 32 bit systems libp11-kit0installed 0.25.5-3 no fix yet
Medium CVE-2026-19499glibc: Buffer Overflow in strfmon right-justification padding libc-bin, libc6installed 2.41-12+deb13u4 no fix yet
Medium CVE-2026-19542glibc: Fix out-of-bounds array write in tdelete libc-bin, libc6installed 2.41-12+deb13u4 no fix yet

Showing the 40 most severe of 184 distinct vulnerabilities (342 findings, one per affected package).

Packages

Debian packages
151

Image configuration

Base OS
Debian 13.7 (trixie)
Default user
root (no USER set; the entrypoint may still drop privileges)
Entrypoint
/docker-entrypoint.sh
Command
nginx -g daemon off;
Exposed ports
80/tcp
Image created
2026-10-28
amd64 digest
sha256:b565a9579cdabe43de09a5a278dc95ceee721dae1cacf85247effc4f6630d511

Other nginx tags

nginx:1.30-alpine64 MB unpacked · 26 MB downloadC 1H 2M 2L 44 nginx:1.30-alpine-slim13 MB unpacked · 5.7 MB download✓ 0 known

Platform sizes and layers: Docker Hub API, checked 2026-11-01. Unpacked size, files and SBOM: measured 2026-10-31 from digest sha256:b565a9579cda. Vulnerabilities: Trivy re-scan 2026-11-01, database 2026-11-01. Methodology.