INFORMATIONAL

In Nginx, all versions, a number of unsafe default configuration values exists in the web server that can be attacked via the network resulting in disclosure of information and availability. These include but are not limited to:

1. Not enough file descriptors per worker
2. The error_log off directive
3. Not enabling keepalive connections to upstream servers
4. Forgetting how directive inheritance works
5. The proxy_buffering off directive
6. Improper use of the if directive
7. Excessive health checks
8. Unsecured access to metrics
9. Using ip_hash when all traffic comes from the same /24 CIDR block
10. Not taking advantage of upstream groups