Ingress NGINX End of Life (EOL) Dates & Support Timeline
Complete end-of-life dates, support windows, and security status for all Ingress NGINX versions. Data sourced from endoflife.date and official vendor documentation. Updated at every deploy.
| Version | Latest Release | Release Date | EOL Date | Days | Status |
|---|---|---|---|---|---|
| 1 | 1.15.1 | Aug 24, 2021 | Mar 31, 2026 | 101 days past EOL | EOL |
Ingress NGINX lifecycle status — the real story
Ingress NGINX is one of the most consequential end-of-life events in modern infrastructure: the Kubernetes project officially retired it in March 2026, announced November 11, 2025 by SIG Network and the Security Response Committee. After the final release (1.15.1, March 2026) there will be no further releases, no bug fixes, and — critically — no fixes for any security vulnerability ever discovered again, in a component that by design sits on the cluster edge parsing untrusted traffic.
The retirement wasn't sudden decay: the project ran for years on one or two volunteer maintainers, and its famous flexibility (arbitrary NGINX directives via "snippets" annotations) turned into unfixable attack surface — the IngressNightmare vulnerability cluster of March 2025 was the loudest warning. Kubernetes' official guidance is to migrate to the Gateway API or another maintained ingress controller immediately.
The scale of the problem is the story: ingress-nginx was the default ingress for a huge share of production Kubernetes clusters, and migrations of edge routing are slow, risky projects. Every cluster still running it past March 2026 is accumulating permanently unpatchable CVEs at its most exposed point — which is why commercial extended support for it appeared almost immediately.
What does Ingress NGINX end of life mean for your organization?
When a version of Ingress NGINX reaches end of life, the maintainers stop issuing security patches. Vulnerabilities discovered after this date are publicly disclosed on the National Vulnerability Database, exploit code appears on GitHub, and your systems remain permanently exposed.
The CVE blind spot: Most vulnerability scanners check for known CVEs but do not flag the accumulation of unpatched vulnerabilities in EOL software. With a zero-day, nobody knows about the vulnerability. With EOL software, the vulnerability is public — listed, rated, and often weaponized — but no patch will ever exist. This is the most dangerous gap in enterprise security posture.
Organizations running EOL Ingress NGINX should treat it as a vulnerability class in their risk register, apply compensating controls (network segmentation, enhanced monitoring, access restriction), and prioritize migration to a supported version.
Extended Support Options
If you cannot migrate immediately, extended support vendors provide continued security patches for EOL Ingress NGINX versions. This is a bridge, not a permanent solution — plan your migration in parallel.
Never-Ending Support for Ingress NGINX — commercial security patches beyond end of life.
Learn More →We work with vetted extended support vendors. Tell us what you need and we'll connect you with the right provider.
Contact Us →