Home Plans Products
Tools
Technology Trends Keyword Lists Browser Extensions
Features
Lead Generation Market Analysis Sales Intelligence
Resources
FAQ About Contact Blog
Account
Login Sign up
Home / Blog / Nginx 1.15.6
Security Advisory

Nginx 1.15.6: 3 Critical CVEs Affecting 281 Websites

📅 June 07, 2026 ·⏱ 5 min read ·🔒 SiteRecipe Security Team
281 websites still running Nginx 1.15.6  → View full list
3
Total
2
High
1
Medium

Nginx 1.15.6 is a widely-used web server powering over 281 websites worldwide, but recent security assessments have uncovered serious vulnerabilities that put your site at risk. Three CVEs have been identified in this version, including two high-severity flaws that could allow attackers to exploit HTTP/2 implementation weaknesses. If your website runs Nginx 1.15.6, immediate action is required to protect your infrastructure from potential memory exhaustion, CPU overload, and data disclosure attacks.

This comprehensive guide will help you understand these vulnerabilities, identify if your server is affected, and walk you through the upgrade process step-by-step. We'll explain the technical details in plain language so you can make informed decisions about your web server security.

What is Nginx 1.15.6?

Nginx is one of the most popular open-source web servers globally, handling everything from static website files to complex application requests. Version 1.15.6 was released as a development branch update in 2018 and is still running on hundreds of production websites today. Nginx is preferred by many administrators because it's lightweight, fast, and can handle thousands of concurrent connections efficiently.

However, like all software, Nginx 1.15.6 has security weaknesses that were discovered after its release. These vulnerabilities specifically affect the HTTP/2 module and the MP4 video module—features that many modern websites use to deliver content faster and stream media files. Running an outdated version leaves your website vulnerable to attacks that could crash your server, consume excessive resources, or expose sensitive data.

Key Vulnerabilities in Nginx 1.15.6

3 CVEs found. The most critical are explained below.

HIGH CVE-2018-16843 7.5/10 · CVSS v3.1 ⏱ Immediate
HTTP/2 Memory Overload Vulnerability

This vulnerability affects websites using Nginx with HTTP/2 enabled. An attacker can send specially crafted requests that force your server to consume excessive memory, similar to filling up a tank beyond its capacity.

Impact: Your website could slow down dramatically or crash entirely, making it unavailable to legitimate customers and visitors.

↗ View on NVD
HIGH CVE-2018-16844 7.5/10 · CVSS v3.1 ⏱ Immediate
HTTP/2 CPU Overload Vulnerability

Similar to the memory issue, this vulnerability in HTTP/2 allows attackers to send requests that force your server's processor to work excessively hard, like revving a car engine to the maximum.

Impact: Your website becomes slow and unresponsive for all users, effectively taking your site offline even though it's technically running.

↗ View on NVD
MEDIUM CVE-2018-16845 6.1/10 · CVSS v3.1 ⏱ Within 7 days
MP4 File Processing Crash Vulnerability

This vulnerability only affects servers that serve MP4 video files through Nginx. An attacker can upload or reference a malicious MP4 file that crashes the server process.

Impact: Your video streaming or media content could be disrupted, and attackers might potentially access sensitive information from server memory.

↗ View on NVD

Is your website running Nginx 1.15.6?

Scan your site in 30 seconds. Used by 500+ web agencies.

How to Check If Your Website Is Affected

How to Fix These Vulnerabilities

Conclusion

The three CVEs affecting Nginx 1.15.6—CVE-2018-16843, CVE-2018-16844, and CVE-2018-16845—represent genuine security risks that could compromise your website's performance and visitor data. With 281 websites still running this vulnerable version, you're not alone in facing this challenge, but that also means attackers are actively looking for unpatched servers. Upgrading to a newer version of Nginx takes just minutes and will eliminate these security holes permanently.

Don't wait until an attack happens. Use SiteRecipe.com's comprehensive security scanning tools to identify vulnerabilities across your entire web infrastructure, monitor your server health in real-time, and receive alerts when new CVEs are discovered. Our platform makes it easy to track version updates and ensure you're always running secure, optimized software. Start your free security audit today at SiteRecipe.com and gain peace of mind knowing your website is protected.

Frequently Asked Questions

What happens if I don't upgrade from Nginx 1.15.6?
Your server remains vulnerable to attacks that can crash worker processes, consume excessive memory and CPU resources, or disclose sensitive information. Attackers can use these vulnerabilities to launch denial-of-service attacks, making your website slow or unavailable to visitors.
Will upgrading Nginx break my website?
Upgrading to a newer stable version of Nginx is designed to be backward compatible with most configurations. However, you should always back up your configuration files first (as shown in our fix guide) and test on a staging server if possible before deploying to production.
How often should I check for Nginx vulnerabilities?
You should check for updates monthly or enable automatic security updates on your server. SiteRecipe.com automatically monitors for new CVEs and alerts you when vulnerabilities affecting your infrastructure are discovered, eliminating the need for manual monitoring.
Do all Nginx installations have these vulnerabilities?
Only Nginx 1.15.6 and earlier versions (before 1.15.7 and 1.14.1) are affected. Additionally, CVE-2018-16843 and CVE-2018-16844 only impact servers where the HTTP/2 module is compiled and enabled, though you should still upgrade for the other vulnerability.
Can I upgrade Nginx without downtime?
Yes, with proper planning. You can use Nginx's graceful reload feature or set up a load balancer to redirect traffic during the upgrade. Most updates take only seconds to apply and shouldn't cause noticeable interruption to your visitors.

Generate white-label reports for your clients

Web agencies use SiteRecipe to produce branded PDF security reports in 30 seconds.

DISCLAIMER: This report is based on publicly available CVE data from the National Vulnerability Database (NVD) maintained by NIST. Detection of a technology version does not confirm active exploitation on any specific website. For informational purposes only. SiteRecipe is not responsible for actions taken based on this report. Always consult a qualified security professional.

Source: nvd.nist.gov · Published: June 07, 2026 · SiteRecipe.com