USN-8955-2: nginx patch extended to Ubuntu 20.04, 18.04, 16.04 and 14.04

Ubuntu released security advisory USN-8955-2 on 5 November 2026, extending nginx fixes already released on 26 October via USN-8955-1 to older versions still under extended support. Anyone running web servers or reverse proxies on Ubuntu 20.04, 18.04, 16.04 or 14.04 LTS must update the nginx package.

What it fixes

USN-8955-1 patched nginx vulnerabilities on Ubuntu 26.10, Ubuntu 26.04 LTS, Ubuntu 24.04 LTS and Ubuntu 22.04 LTS. This update brings the same fixes to Ubuntu 20.04 LTS, Ubuntu 18.04 LTS, Ubuntu 16.04 LTS and Ubuntu 14.04 LTS, and adds the CVE-2026-42533 patch to these releases as well.

The most significant flaw remains CVE-2026-42533: nginx handled certain map directives using regex matching and capture variables incorrectly, allowing a remote attacker to exploit this issue to crash nginx (denial of service) or potentially execute arbitrary code. This is not a recent 2026 discovery: the upstream bug was already fixed in nginx 1.30.4 and 1.31.3, released on 15 July 2026. There is an important precedent worth noting: a public PoC/exploit was released on 27 July 2026, before the initially announced date of 5 August, indicating that exposed configurations should not delay updates.

The advisory also lists other vulnerabilities closed by the original bulletin: alias/rewrite (CVE-2026-15176), map with regex (CVE-2026-93479), HTTP/3 buffering (CVE-2026-95101, limited to 26.04 and 26.10), SSI with asynchronous I/O (CVE-2026-97205) and SSL session ticket key reuse without explicit rotation (CVE-2026-97629, on 24.04, 26.04 and 26.10).

Fixed versions and who can install them

Release	nginx package	Patch access
20.04 LTS (focal)	1.18.0-0ubuntu1.7+esm4	Requires Ubuntu Pro
18.04 LTS (bionic)	1.14.0-0ubuntu1.11+esm5	Requires Ubuntu Pro
16.04 LTS (xenial)	1.10.3-0ubuntu0.16.04.5+esm10	Ubuntu Pro + Legacy Support add-on
14.04 LTS (trusty)	1.4.6-1ubuntu3.9+esm9	Ubuntu Pro + Legacy Support add-on

All four releases require an active Ubuntu Pro subscription for updates; on 16.04 and 14.04, now outside the standard support window, the Legacy Support add-on is also required. Users still managing machines on these versions without active Pro remain exposed: consider planning migration to a supported release or enabling coverage before deploying configurations that use map with regex.