low

Server header discloses nginx version with published CVEs

All HTTPS responses

CVSS 3.7CWE-200category info-disc

description

All responses from acme.dev include a `Server: nginx/1.18.0` header. nginx 1.18.0 was released in April 2020 and has known CVEs (CVE-2021-23017, CVE-2022-41741, CVE-2022-41742) that have been patched in subsequent releases. The disclosed version narrows the attacker's exploit search and indicates the host has not been updated in over four years.

evidence

Request

GET / HTTP/1.1
Host: acme.dev

Response

HTTP/1.1 200 OK
Server: nginx/1.18.0
Date: 2026-05-20T03:47:14Z
Content-Type: text/html
...

reproduction steps

Issue `curl -I https://acme.dev/` and observe the `Server` header.

remediation

Suppress the version banner and upgrade off the EOL release (1.18).

nginx

server_tokens off;

rotate the credentials you provided.

we ran the scan with the credentials you supplied. treat them as compromised and rotate now.

couldn't reproduce this finding?

if it does not reproduce from the evidence above, you get back what this finding cost you: its credits for a credit unlock, or a cash refund for a finding bought through our earlier per-finding checkout. see how claims work, or email team@recon.sh with finding ID f7 and scan ID sample.