← Legacy view v2 (rp.*)

nginx/nginx

https://github.com/nginx/nginx · lang: c · LOC: · source: user_submitted

Quality
56.9
Grade C
Security
90.0
Findings
49
0 critical · 10 high
Status
completed
May 20, 2026 15:23
low: 30 high: 10 info: 5 medium: 4
Top rules by occurrence
RuleSeverityCount
AIC003 Duplicated implementation block across source files low 30
MINED004 Weak Crypto high 4
SEC029 Server-Side Request Forgery (SSRF) — outbound HTTP from use… high 4
MINED075 C Malloc No Check info 3
SEC045 eval()/exec() on stored or user-supplied data medium 3
MINED115 GitHub Action pinned to mutable ref (not 40-char SHA) high 2
SEC013 Path Traversal — User Input in File Path high 1
CORE_LARGE_FILES Average file size is 1080 lines (recommend <300) medium 1
CORE_NO_TESTS No test files found high 1
First 49 findings (severity-sorted)
high CORE_NO_TESTS No test files found 
No test files found
high MINED004 Weak Crypto CWE-327
src/core/ngx_crypt.c:58 · conf 1.00 
[MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums).
high MINED004 Weak Crypto CWE-327
src/http/modules/ngx_http_secure_link_module.c:16 · conf 1.00 
[MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums).
high MINED004 Weak Crypto CWE-327
src/mail/ngx_mail_imap_module.c:31 · conf 1.00 
[MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums).
high MINED115 GitHub Action pinned to mutable ref (not 40-char SHA) CWE-829
.github/workflows/buildbot.yml:11 · conf 0.90 
[MINED115] Action `nginx/ci-self-hosted/.github/workflows/nginx-buildbot.yml` pinned to mutable ref `@main`: `uses: nginx/ci-self-hosted/.github/workflows/nginx-buildbot.yml@main` resolves at workflo…
high MINED115 GitHub Action pinned to mutable ref (not 40-char SHA) CWE-829
.github/workflows/check-pr.yml:8 · conf 0.90 
[MINED115] Action `nginx/ci-self-hosted/.github/workflows/nginx-check-pr.yml` pinned to mutable ref `@main`: `uses: nginx/ci-self-hosted/.github/workflows/nginx-check-pr.yml@main` resolves at workflo…
high SEC013 Path Traversal — User Input in File Path
src/http/ngx_http_cache.h:193 · conf 0.80 
[SEC013] Path Traversal — User Input in File Path: User-controlled input used in file path without sanitization. Allows reading arbitrary files.
high SEC029 Server-Side Request Forgery (SSRF) — outbound HTTP from user input
src/core/ngx_inet.h:123 · conf 1.00 
[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.25…
high SEC029 Server-Side Request Forgery (SSRF) — outbound HTTP from user input
src/core/ngx_string.h:190 · conf 1.00 
[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.25…
high SEC029 Server-Side Request Forgery (SSRF) — outbound HTTP from user input
src/core/ngx_syslog.c:130 · conf 1.00 
[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.25…
medium CORE_LARGE_FILES Average file size is 1080 lines (recommend <300) 
Average file size is 624 lines (recommend <300)
medium SEC045 eval()/exec() on stored or user-supplied data
src/core/ngx_regex.h:64 · conf 1.00 
[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even admin-stored data — is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ …
medium SEC045 eval()/exec() on stored or user-supplied data
src/http/ngx_http_variables.h:88 · conf 1.00 
[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even admin-stored data — is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ …
medium SEC045 eval()/exec() on stored or user-supplied data
src/stream/ngx_stream_variables.h:84 · conf 1.00 
[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even admin-stored data — is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ …
low AIC003 Duplicated implementation block across source files
src/core/ngx_sha1.c:15 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
src/event/modules/ngx_epoll_module.c:498 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
src/event/modules/ngx_select_module.c:39 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
src/event/modules/ngx_win32_poll_module.c:12 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
src/event/modules/ngx_win32_select_module.c:1 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
src/event/modules/ngx_win32_select_module.c:41 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
src/event/ngx_event_acceptex.c:141 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
src/event/ngx_event_udp.c:26 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
src/event/ngx_event_udp.c:271 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
src/event/quic/ngx_event_quic_udp.c:9 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
src/event/quic/ngx_event_quic_udp.c:24 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
src/http/modules/ngx_http_chunked_filter_module.c:22 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
src/http/modules/ngx_http_gunzip_filter_module.c:68 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
src/http/modules/ngx_http_gzip_filter_module.c:528 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
src/http/modules/ngx_http_gzip_static_module.c:90 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
src/http/modules/ngx_http_headers_filter_module.c:127 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
src/http/modules/ngx_http_limit_conn_module.c:231 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
src/http/modules/ngx_http_limit_req_module.c:267 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
src/http/modules/ngx_http_limit_req_module.c:268 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
src/http/modules/ngx_http_limit_req_module.c:483 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
src/http/modules/ngx_http_not_modified_filter_module.c:19 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
src/http/modules/ngx_http_random_index_module.c:76 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
src/http/modules/ngx_http_range_filter_module.c:63 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
src/http/modules/ngx_http_range_filter_module.c:64 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
src/http/modules/ngx_http_split_clients_module.c:90 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
src/http/modules/ngx_http_static_module.c:55 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
src/http/modules/ngx_http_static_module.c:144 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
src/http/modules/ngx_http_sub_filter_module.c:102 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
src/http/modules/ngx_http_try_files_module.c:141 · conf 0.86 
Duplicated implementation block across source files
low AIC003 Duplicated implementation block across source files
src/http/modules/ngx_http_tunnel_module.c:270 · conf 0.86 
Duplicated implementation block across source files
info MINED004 Weak Crypto CWE-327
· conf 0.20 
[MINED004] Weak Crypto (and 2 more): Same pattern found in 2 additional files. Review if needed.
info MINED075 C Malloc No Check CWE-690
src/os/unix/ngx_alloc.c:22 · conf 1.00 
[MINED075] C Malloc No Check: malloc/calloc/realloc return value used without checking for NULL.
info MINED075 C Malloc No Check CWE-690
src/os/unix/ngx_errno.c:175 · conf 1.00 
[MINED075] C Malloc No Check: malloc/calloc/realloc return value used without checking for NULL.
info MINED075 C Malloc No Check CWE-690
src/os/win32/ngx_alloc.c:21 · conf 1.00 
[MINED075] C Malloc No Check: malloc/calloc/realloc return value used without checking for NULL.
info SEC029 Server-Side Request Forgery (SSRF) — outbound HTTP from user input
· conf 0.20 
[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input (and 1 more): Same pattern found in 1 additional files. Review if needed.

Reading from rp.scan + rp.finding + rp.rule (unified schema, R78 series). Legacy data path unchanged. Compare with /scan/9f08cd24-08f7-4a0a-8ed3-f69967e24690/.