nginx has shipped 40 memory-safety bugs.

What you get

Memory safety, where it actually matters.

Rust is not a marketing word here. It is a compiler that refuses to build the code that produced most of nginx's security history.

Head to head

15 bugs in the jobs xin does too.

Not modules xin skipped — the request parser, the rewrite engine, byte ranges, upstream response handling, the resolver. Same job, same hostile input, different language.

• CVE-2026-42533 major nginx 0.9.6–1.31.2

  Buffer overflow when using map and regex

  xin implements both map and regex locations. The lowering runs in xin-ir and xin-engine, both #![forbid(unsafe_code)].

• CVE-2026-9256 medium nginx 0.1.17–1.31.0

  Buffer overflow in ngx_http_rewrite_module

  rewrite / return / try_files are implemented and lowered by xin, in safe Rust.

• CVE-2026-42945 medium nginx 0.6.27–1.30.0

  Buffer overflow in ngx_http_rewrite_module

  Same module, same year, a second overflow. xin's rewrite lowering is BP-008, entirely in safe Rust.

• CVE-2026-40701 medium nginx 1.19.0–1.30.0

  Resolver use-after-free in OCSP

  xin ships its own resolver (xin-resolver). It contains no unsafe code at all.

• CVE-2021-23017 medium nginx 0.6.18–1.20.0

  1-byte memory overwrite in resolver

  An off-by-one writing a single '.' past a heap buffer in ngx_resolver_copy(); remote code execution was demonstrated. An off-by-one on a slice is a panic in safe Rust, not a write.

• CVE-2017-7529 medium nginx 0.5.6–1.13.2

  Integer overflow in range filter

  xin implements byte ranges, including multipart. The overflow leaked cache memory because the bad offset was then used to index; in Rust that index is bounds-checked.

• CVE-2016-4450 medium nginx 1.3.9–1.11.0

  NULL pointer dereference while writing client request body

  Request-body buffering to disk is a path xin implements. Rust has no null pointer to dereference here.

• CVE-2016-0742 medium nginx 0.6.18–1.9.9

  Invalid pointer dereference in resolver

• CVE-2016-0746 medium nginx 0.6.18–1.9.9

  Use-after-free during CNAME response processing in resolver

  Use-after-free is the defect class Rust's ownership model exists to eliminate.

• CVE-2013-2070 medium nginx 1.1.4–1.2.8, 1.3.9–1.4.0

  Memory disclosure with specially crafted HTTP backend responses

  Parsing an upstream response is exactly what a reverse proxy does. xin parses them in xin-h1, which is #![forbid(unsafe_code)] and fuzzed.

• CVE-2013-2028 major nginx 1.3.9–1.4.0

  Stack-based buffer overflow with specially crafted request

  The chunked-encoding overflow — a signed/unsigned confusion in the request parser, and the best-known remotely exploitable nginx bug. xin's chunked decoder is safe Rust and has a dedicated fuzz target.

• CVE-2012-1180 major nginx 0.1.0–1.1.16

  Memory disclosure with specially crafted backend responses

  Upstream response parsing again, four years before the same class recurred.

• CVE-2011-4315 medium nginx 0.6.18–1.1.7

  Buffer overflow in resolver

• CVE-2009-2629 major nginx 0.1.0–0.8.14

  Buffer underflow vulnerability

  A pointer walked backwards out of the request buffer during URI parsing. In safe Rust a slice cannot be indexed below its start.

• CVE-2009-3896 major nginx 0.1.0–0.8.13

  Null pointer dereference vulnerability