# Security issues with Nginx

**URL:** <https://www.ruby-forum.com/t/security-issues-with-nginx/227396>\
**Category:** NGINX\
**Created:** [March 14, 2013, 8:43am UTC](https://www.ruby-forum.com/t/security-issues-with-nginx/227396 "2013-03-14T08:43:50Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Joe\_M](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/b5e925/32.png) [@Joe\_M](https://www.ruby-forum.com/u/Joe_M)\
**Post date:** [March 14, 2013, 8:43am UTC](https://www.ruby-forum.com/t/security-issues-with-nginx/227396/1 "2013-03-14T08:43:50Z")

</div>

Hey all

Im new to Nginx and wanted to know if any of you familiar with any Known  
security issues in Nginx (for example:  
[Nginx & PHP via FastCGI important security issue](http://cnedelcu.blogspot.co.il/2010/05/nginx-php-via-fastcgi-important.html))

Thanks  
Joe

Posted at Nginx Forum:

> **[\[Q\] Security issues with Nginx](https://forum.nginx.org/read.php?2,237336,237336#msg-237336)**
>
> Hey all Im new to Nginx and wanted to know if any of you familiar with any Known security issues in Nginx (for example: http://cnedelcu.blogspot.co.il/2010/05/nginx-php-via-fastcgi-important.html) Thanks Joe

---

<div class="post-metadata">

**Author:** ![Joe\_M](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/b5e925/32.png) [@Joe\_M](https://www.ruby-forum.com/u/Joe_M)\
**Post date:** [March 14, 2013, 9:40am UTC](https://www.ruby-forum.com/t/security-issues-with-nginx/227396/2 "2013-03-14T09:40:58Z")

</div>

Hello!

On Thu, Mar 14, 2013 at 03:43:17AM -0400, Joe M wrote:

> Hey all
> 
> Im new to Nginx and wanted to know if any of you familiar with any Known  
> security issues in Nginx (for example:  
> [http://cnedelcu.blogspot.co.il/2010/05/nginx-php-via-fastcgi-important.html](http://cnedelcu.blogspot.co.il/2010/05/nginx-php-via-fastcgi-important.html))

This was discussed here once discovered[1], and the conclusion is:  
it’s not a security issue in nginx, but rather a misconfiguration  
of php.

Making sure you’ve configured it correctly (i.e. switched off  
cgi.fix\_pathinfo=0 in php.ini) is a good idea though.

[1] [nginx 0day exploit for nginx + fastcgi PHP](http://mailman.nginx.org/pipermail/nginx/2010-May/020461.html)

–  
Maxim D.

> **[nginx: donation](http://nginx.org/en/donation.html)**

---

<div class="post-metadata">

**Author:** ![Joe\_M](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/b5e925/32.png) [@Joe\_M](https://www.ruby-forum.com/u/Joe_M)\
**Post date:** [March 14, 2013, 12:21pm UTC](https://www.ruby-forum.com/t/security-issues-with-nginx/227396/3 "2013-03-14T12:21:44Z")

</div>

OK, great

Any other security issues or misconfiguration I should know about?

Thanks  
Joe

Posted at Nginx Forum:

> **[Re: \[Q\] Security issues with Nginx](https://forum.nginx.org/read.php?2,237336,237345#msg-237345)**
>
> Hey all Im new to Nginx and wanted to know if any of you familiar with any Known security issues in Nginx (for example: http://cnedelcu.blogspot.co.il/2010/05/nginx-php-via-fastcgi-important.html) Thanks Joe