STIGQter: STIG Summary: F5 NGINX Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 25 Nov 2025:

NGINX must restrict the ability of individuals to launch denial-of-service (DoS) attacks against other information systems.

DISA Rule

SV-278394r1171934_rule

Vulnerability Number

V-278394

Group Title

SRG-APP-000246

Rule Version

NGNX-APP-001030

Severity

CAT II

CCI(s)

• CCI-001094 - Restrict the ability of individuals to launch organization-defined denial of service attacks against other systems.

Weight

10

Fix Recommendation

Determine the path to NGINX config file(s):

# nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

Add or modify the client_body_timeout, client_header_timeout and send_timeout directives to have a value of 10 seconds or lower. Setting this value in the http context will cover everything unless overridden in subsequent server or location contexts.

client_body_timeout 10s;
client_header_timeout 10s;
send_timeout 10s;

After saving the configuration, reload NGINX:

# nginx -s reload

Check Contents

Determine the path to NGINX config file(s):

# nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

Verify timeouts and send timeouts exist in config file and the timeout value of 10 seconds (or less) has been configured for client headers and body.

nginx -c <path to nginx config> -qT | grep timeout
client_body_timeout 10s;
client_header_timeout 10s;
send_timeout 10s;

If the client_header_timeout, client_body_timeout and send_timeout are unset or have values greater than 10, this is a finding.

Vulnerability Number

V-278394

Documentable

False

Rule Version

NGNX-APP-001030

Severity Override Guidance

Determine the path to NGINX config file(s):

# nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

Verify timeouts and send timeouts exist in config file and the timeout value of 10 seconds (or less) has been configured for client headers and body.

nginx -c <path to nginx config> -qT | grep timeout
client_body_timeout 10s;
client_header_timeout 10s;
send_timeout 10s;

If the client_header_timeout, client_body_timeout and send_timeout are unset or have values greater than 10, this is a finding.

Check Content Reference

M

Target Key

5720