STIGQter: STIG Summary: F5 NGINX Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 25 Nov 2025:

NGINX must generate error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries.

DISA Rule

SV-278395r1172748_rule

Vulnerability Number

V-278395

Group Title

SRG-APP-000266

Rule Version

NGNX-APP-001070

Severity

CAT II

CCI(s)

• CCI-001312 - Generates error messages that provide information necessary for corrective actions without revealing information that could be exploited.

Weight

10

Fix Recommendation

Determine the path to NGINX config file(s):

# nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

Add or modify the "server_tokens" directive to set to "off" or set to a custom string without the version information.

http {
server_tokens off;
...
}

Restart nginx after modifying the configuration:

# nginx -s reload

Check Contents

Determine the path to NGINX config file(s):

# nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

Verify that the "server_tokens" directive is present, is not set to "on", and is not set to a custom string that identifies version information.

nginx -c <path to nginx config> -qT | grep server_tokens
server_tokens off;

If the "server_tokens" directive is missing, this is a finding.

If the "server_tokens" directive is set to "on", this is a finding.

If the "server_tokens" directive includes the version number, this is a finding.

Vulnerability Number

V-278395

Documentable

False

Rule Version

NGNX-APP-001070

Severity Override Guidance

Determine the path to NGINX config file(s):

# nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

Verify that the "server_tokens" directive is present, is not set to "on", and is not set to a custom string that identifies version information.

nginx -c <path to nginx config> -qT | grep server_tokens
server_tokens off;

If the "server_tokens" directive is missing, this is a finding.

If the "server_tokens" directive is set to "on", this is a finding.

If the "server_tokens" directive includes the version number, this is a finding.

Check Content Reference

M

Target Key

5720