https://security.snyk.io/vuln/SNYK-DEBIAN13-NGINX-16732761
https://security.snyk.io/vuln/SNYK-ALPINE323-NGINX-16722461
So it seems that Snyk is taking almost a week to get advisories out for an RCE