What’s Vulnerable › Vulnerabilities

CVE-2020-36309

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-04-06 · updated 2026-06-17

Description

ngx_http_lua_module (aka lua-nginx-module) before 0.10.16 in OpenResty allows unsafe characters in an argument when using the API to mutate a URI, or a request or response header.

Affected products

• openresty Lua-Nginx-Module: before 0.10.16 — fixed in 0.10.16

How to fix

Upgrade to a fixed version: openresty Lua-Nginx-Module 0.10.16. Check the vendor advisory for mitigations.

References

• https://github.com/openresty/lua-nginx-module/compare/v0.10.15...v0.10.16
• https://github.com/openresty/lua-nginx-module/pull/1654
• https://news.ycombinator.com/item?id=26712562
• https://security.netapp.com/advisory/ntap-20210507-0005/
• https://github.com/openresty/lua-nginx-module/compare/v0.10.15...v0.10.16
• https://github.com/openresty/lua-nginx-module/pull/1654
• https://lists.debian.org/debian-lts-announce/2025/06/msg00026.html
• https://news.ycombinator.com/item?id=26712562
• https://security.netapp.com/advisory/ntap-20210507-0005/

Get alerted when CVE-2020-36309 or the next vulnerability affects your stack