Five NGINX CVEs Depend on Configuration, So Exposure Must Be Measured Beyond Version

Two NGINX releases, 1.31.7 and 1.30.6, fix five vulnerabilities, each triggered only when a specific directive is enabled. This makes exposure a question of configuration rather than version alone. The article explains that scan-based fingerprinting, such as ZoomEye queries on app or Server header values, cannot see those directives and so cannot reliably count vulnerable deployments. It suggests narrowing candidates, for example TLS-terminating edge hosts or QUIC-terminating deployments, and then confirming exposure by reviewing each asset's configuration with nginx -T. It also stresses reporting search queries, fields, collection dates and units accurately when presenting exposure counts.