STIGQter: STIG Summary: F5 NGINX Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 25 Nov 2025:

NGINX must identify prohibited mobile code.

DISA Rule

SV-278393r1171931_rule

Vulnerability Number

V-278393

Group Title

SRG-APP-000206

Rule Version

NGNX-APP-000850

Severity

CAT II

CCI(s)

CCI-001166 - Identify organization-defined unacceptable mobile code.
CCI-001662 - Take organization-defined corrective action when organization-defined unacceptable mobile code is identified.
CCI-001169 - Prevent the download of organization-defined unacceptable mobile code.
CCI-001170 - Prevents the automatic execution of mobile code in organization-defined software applications.

Weight

Fix Recommendation

Determine the path to NGINX config file(s):

# nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

Remove any unnecessary or unpermitted modules from the configuration.

After saving the configuration, reload NGINX:

# nginx -s reload

Check Contents

Determine the path to NGINX config file(s):

# nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

# grep load_module /etc/nginx/nginx.conf
load_module modules/ngx_http_app_protect_module.so;

If modules are loaded that are not required or known, this is a finding.

Vulnerability Number

V-278393

Documentable

False

Rule Version

NGNX-APP-000850

Severity Override Guidance

Determine the path to NGINX config file(s):

# nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

# grep load_module /etc/nginx/nginx.conf
load_module modules/ngx_http_app_protect_module.so;

If modules are loaded that are not required or known, this is a finding.

Check Content Reference

Target Key

5720