Your nginx version has a published CVE

Enabling the check

This check is silent by default, and deliberately so. Gixy is a static analyzer: it parses your configuration and has no view of the binary serving it. Guessing a version from the config would produce confident nonsense. So you supply it:

gixy --nginx-version=1.29.8 /etc/nginx/nginx.conf

Get the real number from the binary you are actually running:

nginx -v
# nginx version: nginx/1.29.8

What Gixy reports

[nginx_cves] Known nginx CVE affects your installed version.
  Severity: HIGH
  Reason: CVE-2025-53859 affects nginx 1.29.0 and is fixed in 1.29.1.

Two kinds of finding

The check distinguishes between them, which matters for how urgently you act:

• Version-range CVEs. The flaw is in the binary. If your version falls in the affected range it applies to you, whatever your configuration says. Reported on the version alone.
• Config-triggered CVEs. The vulnerable code path only runs when specific directives are present -- the mp4 module, resolver, HTTP/2 and HTTP/3 handling. These are reported only when Gixy finds the trigger in your config, and the finding attaches to the offending directives so you can see why.

That second category is the reason to run this against your config rather than against a version-number spreadsheet. A CVE in the mp4 module is not your problem if you never compiled it in.

The fix

Upgrade to the fixed release named in the finding. There is no configuration workaround for a binary flaw.

# RHEL / Rocky / AlmaLinux
dnf upgrade nginx

# Debian / Ubuntu
apt update && apt install --only-upgrade nginx

# Confirm, then reload
nginx -v
nginx -t && nginx -s reload

For a config-triggered CVE you cannot patch immediately, removing the trigger is a real mitigation -- disable the mp4 module, or drop the directive the finding points at -- but treat it as a stopgap until the upgrade lands.

Verify the fix

# Re-run with the new version number
gixy --nginx-version=$(nginx -v 2>&1 | grep -oP '\d+\.\d+\.\d+') /etc/nginx/nginx.conf

When this is a false positive

Backported distribution packages, as above -- the single most common reason for a finding you can safely close. Beyond that, a config-triggered CVE reported against a module you have compiled out is worth a moment's checking with nginx -V: Gixy sees the directive in your config, not whether the module handling it was built in.

Reference

• nginx_cves in the Gixy documentation — what the check inspects and its options
• All Gixy checks — the full list by severity
• Plugin source — the exact detection logic

Related

Keep working through your Gixy findings:

Guide

Hide your nginx version

Stop advertising to scanners which CVEs to try.

Index

All Gixy checks

Every check Gixy ships, grouped by severity.

Guide

Gixy in CI/CD

Fail the build when a vulnerable version ships.