PerfoMetrix

All vulnerabilities · nginx

nginx DNS Resolver Vulnerability (CVE-2021-23017): Check Your nginx Version

CVE-2021-23017CVSS 7.7

A one-byte memory overwrite in the nginx resolver can crash workers or allow code execution when the resolver directive is used. See affected versions and how to update.

Is your site affected? Check the nginx version it shows

Passive check: we load your page like a visitor would and read the versions it announces. We never send exploits or attack the site. "Not affected" or "hidden" doesn’t prove a server is safe: a firewall or proxy can hide versions, and only the server itself can confirm its packages.

Affected and fixed versions

AffectedFixed in
>=0.6.18 <1.20.1
1.20.1
1.21.0

CVE-2021-23017 is a one-byte memory overwrite in the DNS resolver built into nginx. If nginx is configured with the resolver directive, an attacker who can spoof DNS responses to the server can crash worker processes and, in some conditions, run code.

Who is affected

  • nginx 0.6.18 up to 1.20.0 (the fix is in 1.20.1 stable and 1.21.0 mainline).
  • Only when the configuration uses resolver, which is common for dynamic upstreams, OCSP stapling and some proxy setups.

What our check looks at

We read the nginx version in your Server header and compare it with the affected range. If the header says only nginx without a number, the version is hidden and we can’t tell.

How to fix it

  1. Update nginx to 1.20.1 or later.
    • Debian/Ubuntu: sudo apt update && sudo apt install --only-upgrade nginx
    • RHEL/AlmaLinux/Rocky: sudo dnf upgrade nginx
  2. Hide the version: server_tokens off; in the http block.

FAQ

We don’t use the resolver directive. Should we still update?

Yes. Versions this old miss many other fixes, and nginx 1.20 itself is long out of support.

Is OpenResty affected?

OpenResty bundles nginx; releases before 1.19.3.2 are affected.

Official advisory

Last updated October 27, 2026 · This product uses data from the NVD API but is not endorsed or certified by the NVD.

Monitor your site for free