# Nginx security advisory (CVE-2016-4450)

**URL:** <https://www.ruby-forum.com/t/nginx-security-advisory-cve-2016-4450/244713>\
**Category:** NGINX\
**Created:** [May 31, 2016, 6:43pm UTC](https://www.ruby-forum.com/t/nginx-security-advisory-cve-2016-4450/244713 "2016-05-31T18:43:42Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rafa\_F](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/958977/32.png) [@Rafa\_F](https://www.ruby-forum.com/u/Rafa_F)\
**Post date:** [May 31, 2016, 6:43pm UTC](https://www.ruby-forum.com/t/nginx-security-advisory-cve-2016-4450/244713/1 "2016-05-31T18:43:42Z")

</div>

Hello!

A problem was identified in nginx code responsible for saving  
client request body to a temporary file. A specially crafted request  
might result in worker process crash due to a NULL pointer dereference  
while writing client request body to a temporary file (CVE-2016-4450).

The problem affects nginx 1.3.9 - 1.11.0.

The problem is fixed in nginx 1.11.1, 1.10.1.

Patch for nginx 1.9.13 - 1.11.0 can be found here:

[http://nginx.org/download/patch.2016.write.txt](http://nginx.org/download/patch.2016.write.txt)

Patch for older nginx versions (1.3.9 - 1.9.12):

[http://nginx.org/download/patch.2016.write2.txt](http://nginx.org/download/patch.2016.write2.txt)

–  
Maxim D.  
[http://nginx.org/](http://nginx.org/)