What a Version Number on an Error Page Tells an Attacker

Last week Duncan Payne posted a screenshot of the Companies House company search falling over. It showed a 502 Bad Gateway and, underneath in small type, nginx/1.18.0.

Duncan’s complaint was that the register keeps going down when small businesses need it, which is fair. What caught my eye was the second line. An error page that prints the server’s software and version tells anyone who looks where to start, and on a penetration test it’s one of the first things we write down.

What the page gave away

nginx is the web server sitting in front of the application. A 502 means it asked the application behind it for a page and didn’t get a usable answer, so it served its own default error page instead. By default that page includes the version. The server_tokens setting controls it, and it’s on unless someone turns it off.

On a normal request, the site doesn’t give its version away. This is its Server header (checked 25 Oct):

$ curl -sI https://find-and-update.company-information.service.gov.uk/ | grep -i '^server'
server: CompaniesHouse

Compare that with the footer on Duncan’s error page: nginx/1.18.0. The version is hidden on the normal path and shows up on the error page. That’s common. Error pages, maintenance pages and old admin hosts are rarely what anyone checks before go-live.

Why 1.18.0 looks bad

nginx 1.18.0 was released on 21 April 2020. The current stable release is 1.30.6. nginx’s security advisories page lists 23 issues whose vulnerable range includes 1.18.0. One is rated major: CVE-2026-42533, a buffer overflow when using map with regular expressions.

That’s roughly what I said in Duncan’s comments. It’s true, but the number on its own doesn’t settle much.

Why the version number can mislead

Linux distributions freeze a version and backport security fixes into it. Ubuntu 22.04 ships nginx 1.18.0 and gets standard security updates until May 2027. Its packages print “nginx/1.18.0 (Ubuntu)” while carrying fixes for problems found long after 2020. Debian 11 also shipped 1.18.0 with backported fixes, though its free security support ended on 31 August 2026.

So a 1.18.0 banner could be a patched distribution package, a package that’s stopped getting fixes, or a build nobody has touched since 2020. From the outside, all three print the same thing.

What a scanner does with it, and what a penetration test does

A vulnerability scanner reads the banner, matches it against a list and reports every advisory in range. That’s how you get a scan report full of nginx findings, some of which only apply if a module like mp4 or WebDAV is switched on, and some of which the distribution fixed years ago.

A pen tester treats the banner as a lead. We check which modules and features are in use, which of the advisories need them, and whether the server behaves like a patched build. Then we report what’s actually exploitable, with the banner itself as a low-risk information disclosure finding. You get a list you can fix instead of a list of maybes. The same gap shows up in what a Cyber Essentials Plus scan checks compared with a pen test.

What to check on your own servers

• Turn the version off. Add server_tokens off; to the http block of your nginx config, which covers the error pages and the Server header.
• Replace the default error pages with your own, at whichever layer serves them: load balancer, CDN or nginx.
• Check the package, not the banner. On Debian or Ubuntu, apt policy nginx shows the exact package revision, and that tells you which fixes you have.
• If the server runs Ubuntu 20.04 or Debian 11, plan the move. Ubuntu 20.04’s standard support ended in May 2025 and Debian 11’s free support in August 2026. After that, fixes come through Ubuntu Pro or paid extended support.

Hiding the version doesn’t fix anything underneath. It just stops you handing out the first step for free.

Not sure which scan findings are real?

Send us the version findings from your last scan report and tell us what’s in scope. We’ll tell you which ones are worth worrying about and what an external pen test would cover.