Forum Widgets
Latest Discussions
IIS and CVE-2026-49975
Hello IIS Team, our SOC Team informed us about the CVE-2026-49975 vulnerability in MS IIS. I could'nt found any patch for this. So my question is - are there any plans for for a patch / hotfix or what can we do to fix this? Greetings Rene Source: https://blog.calif.io/p/codex-discovered-a-hidden-http2-bomb
IIS Site Randomly Returns 404 While App Pool Remains Started
Hello, We have an IIS site running behind Azure Front Door that becomes unavailable every few days. Symptoms: Application Pool remains started Users see the blue "Not Found" page from Azure Front Door When accessing the site directly on the server during the failure, we get a 404 from IIS, not Front Door The site does not recover on its own Recovery requires an App Pool recycle or IIS restart, and sometimes a full server reboot because recycle or IIS restart does not help What it is NOT: No CPU, memory, disk, or network pressure Event logs do not correlate with the outage When it happens: Random and unpredictable Any insights would be appreciated. From the server itself: Please your support.Error executing JScript
I switched from Windows Server 2022 to 2025. I migrated all my domains and it works fine, but with an error: I can't run a script like "<SCRIPT Language="JScript" RUNAT=SERVER>" because it gives me a 500 error. If I go to https://www.vidauna.com/aaa.asp, there's an example from Microsoft, and if the page is refreshed, it gives a 500 error (once yes, once no). Looking for the reason for the error, I found it's because on another of my pages on the same domain I have set the string: "Session.Timeout = 20." If I create a new subdomain with just the example, it works fine, but without the example, I put: <% Session.Timeout = 20 %> It starts doing the same thing. When I refresh the page (F5), it gives a 500 error, and if I refresh it again, it appears fine, and so on. I've been searching for a solution for almost a month and can't find it. I can't have the page that uses JScript on the domain because it doesn't work (it worked fine on the previous server), and I'm trying to find the problem with the example. What I think is that I need to configure something in Windows Server 2025's IIS to prevent this error, but I don't know what it is. I hope someone knows the solution to this problem. Thank you. I'm Spanish, and the text was translated using Google Translate. The content of the aaa.asp example is: <%@ Language= "VBScript" %> <HTML> <BODY> <!-- Call the JScript procedure from within VBScript--> <% call printDate() %> <!--Call the VBScript procedure from within VBScrip--> <% Echo %> <BR> </BODY> </HTML> <%Sub Echo%> <!--Note: this will not output anything unless the page is called with a query string like https://localhost/test.asp?x=1%20have&y=a%20cunning&z=plan --> <% Response.Write "<TABLE BORDER=1>" & _ "<TR><TH>Name</TH><TH>Value</TH></TR>" Set objQueryString = Request.QueryString For Each strSelection In objQueryString Response.Write "<TR><TD>" & strSelection & "</TD><TD>" & _ objQueryString(strSelection) & "</TD></TR>" Next Response.Write "</TABLE>" End Sub %> <SCRIPT Language= "JScript" RUNAT=SERVER> function printDate() { var x x = new Date() Response.Write(x.toString()) Response.Write("<BR>") } </SCRIPT> The error is: Información detallada de error: Módulo IsapiModule Notificación ExecuteRequestHandler Controlador ASPClassic Código de error 0x00000000 Dirección URL solicitada https://www.vidauna.com:443/aaa.asp Ruta de acceso física ...\aaa.asp Método de inicio de sesión Anónimo Usuario de inicio de sesión Anónimo
ARR 3.0 Route to Server Farm Missing
I am encountering a persistent and frustrating issue with Application Request Routing (ARR) 3.0 on my Windows system (details below). I have successfully installed ARR 3.0, but the crucial "Route to Server Farm..." option is consistently missing from the "Action type:" dropdown when I edit or create a URL Rewrite rule in IIS Manager. I have spent a significant amount of time troubleshooting this, and I am hoping someone with more experience might be able to shed some light on what I am missing or what might be going wrong. Here is a detailed breakdown of my situation and the steps I have taken: System Information: Operating System: Windows 10 Pro 64-bit IIS Version: 10.0.19041.1 Problem Description: The "Route to Server Farm..." option is not present in the "Action type:" dropdown when configuring the "Action" of a URL Rewrite rule for my "Default Web Site" (and any other site I've tested). My goal is to use ARR as a reverse proxy to forward requests to a backend Nginx server (running on the same machine or a different one - please specify if relevant). I have created a Server Farm named "NginxFarm" (or whatever you named it) in IIS Manager. 3. Steps Taken So Far (in chronological order as best as I can recall): Initial ARR Installation: I downloaded and successfully ran the ARR 3.0 installer (requestRouter_amd64 (1).exe). The installation completed without any apparent errors. Verification of Modules: In IIS Manager, at the server level, under "Modules," I can see "ApplicationRequestRouting" listed with "Module Type: Native" and "Enabled: True". However, "RequestRouter" was initially missing. Manual Registration Attempts: I tried to register RequestRouter.dll (located in C:\Program Files (x86)\IIS\Application Request Routing\) using regsvr32, but it reported that the entry-point DllRegisterServer was not found. I tried using iisreg.exe (from C:\Windows\System32\inetsrv\) to register RequestRouter.dll, but the command was not recognized. I looked for gacutil.exe to register the DLL in the Global Assembly Cache but could not find it (Windows SDK is not installed). Manual Module Addition (Server Level Configuration Editor): I used the Configuration Editor at the server level to navigate to system.webServer -> modules. I found "ApplicationRequestRouting" listed, but the "type" attribute was empty. I set it to Microsoft.Web.Arr.ApplicationRequestRoutingModule, Microsoft.Web.Arr. "RequestRouter" was missing, so I added a new module with the name "RequestRouter" and the type Microsoft.Web.Arr.RequestRouterModule, Microsoft.Web.Arr. I applied these changes and restarted the entire computer. Checking "Configure Native Modules..." (Default Web Site): I checked the "Configure Native Modules..." option for my "Default Web Site" under "Modules," but "RequestRouter" was not listed there. Examination of applicationHost.config: I located C:\Windows\System32\inetsrv\config\applicationHost.config and made a backup. In the <globalModules> section, I found entries for ARRHelper, RequestRouter (pointing to C:\Program Files (x86)\IIS\Application Request Routing\requestRouter.dll), and ApplicationRequestRouting (which I changed to also point to C:\Program Files (x86)\IIS\Application Request Routing\requestRouter.dll to ensure consistency). The <modules> section within <system.webServer> at the server level now correctly lists ApplicationRequestRouting and RequestRouter with the type attributes set. IIS Logs: I examined the IIS logs in %SystemDrive%\inetpub\logs\LogFiles\ but did not find any specific errors related to the loading or initialization of the ARR modules. The logs primarily show 404 errors for the root and favicon.ico. Full System Restarts: I have restarted my computer multiple times after installing ARR and making configuration changes. Clean Re-installation of ARR 3.0: I uninstalled ARR 3.0 through "Programs and Features," restarted my computer, re-downloaded and re-installed ARR 3.0 as administrator, and restarted again. The issue persists. Server Level Rewrite Configuration: I checked system.webServer -> rewrite -> providers and rules at the server level in the Configuration Editor, and both had zero items. 4. Current Status: "ApplicationRequestRouting" is listed as a Native module and enabled at the server level. "RequestRouter" is listed as a Native module with the correct type at the server level. Neither "RequestRouter" nor "ApplicationRequestRouting" appears in the "Configure Native Modules..." list for the "Default Web Site". The "Route to Server Farm..." option is still missing from the "Action type:" dropdown in the URL Rewrite rule editor. 5. Questions for the Community: Has anyone else encountered this specific issue with ARR 3.0 on a similar system configuration? Are there any known compatibility issues between ARR 3.0 and specific versions of Windows or other IIS components? Are there any prerequisites for ARR 3.0 that might not be obvious or automatically installed? Are there any specific IIS features that need to be enabled for "Route to Server Farm..." to appear? (I have the core Web Server role and Management Tools installed). Could there be an issue with the permissions on the ARR installation directories or the DLL files? Are there any specific entries I should be looking for in the Windows Event Viewer (Application or System logs) that might indicate a problem with ARR? Is there a specific order in which ARR components need to be installed or configured? Are there any alternative methods to enable or verify the functionality of the RequestRouter module? I am at a loss and would greatly appreciate any guidance or suggestions you might have. Thank you in advance for your time and assistance.
IIS URL redirect
I want to enable access to the same website from two different URLs. The website is hosted for internal use. The internal URL is internal.example.com But now I want to open this website to the public using external.example.com There is no option to add a new building to this website. How can I enable URL redirect on IIS to achieve this? I want to access all the internal website pages from an outside URL without any issues. Is there an option to achieve this on IIS?
How to integrate with Angular ngCspNonce`
Good Day I'm trying to set up CSP Nonce support with Angular, using IIS on Windows-based Azure App Service Plans. I can't switch to a different web server due to other requirements, so I'm stuck with IIS. What I need to configure is a replacement for 'nonce-random_nonce_value' In Apache or Nginx, this is trivial, but on IIS how do I tell it to replace "nonce-random_nonce_value" with "nonce-<blah-long-hash>". Thanks
Need Help Understanding Why .NET SDK and Runtime Were Required for IIS Hosting of ASP.NET
I'm hosting an ASP.NET Core application (v6.0.33) on an AWS virtual machine with IIS. I installed the .NET Hosting Bundle matching the application’s version. After verifying the website runs fine with dotnet run, I encountered an "HTTP Error 500.30 - ASP.NET Core App Failed to Start" when trying to access it via IIS. After troubleshooting extensively—including checking various threads on Stack Overflow, GitHub, and Microsoft forums—I found this article https://www.quickpickdeal.com/coding/http-error-500-30-asp-net-core-app-failed-to-start-with-iis-a-real-world-solut that suggested installing not only the Hosting Bundle but also the .NET SDK and Runtime. Surprisingly, this approach worked. My question is: Why did I need all three components (Hosting Bundle, SDK, and Runtime) to get this application working in IIS? I expected the Hosting Bundle alone to be sufficient for deployment. Could there be a dependency that IIS requires that isn't covered by the Hosting Bundle?
IIS Anonymous settings question
Hi Gang, When enabling the Anonymous Authentication, there is an Edit button to set a user. As well, there is also an option to specify a user in Basic Settings for a virtual folder/app in IIS. What is the difference between these two? Many thanks! ============== Found my answer in case anyone is curious...Basic Settings sets the user account for a more limited scope - disk access only. Setting the account via Edit button for the Anonymous auth option has broader access - disk, registry and network.
