 The nginx web-server was not vulnerable to CRIME since 1.0.9/1.1.6 (October/November 2011) using OpenSSL 1.0.0+, and since 1.2.2/1.3.2 (June / July 2012) using all versions of OpenSSL.Note that as of December 2013 the CRIME exploit against HTTP compression has not been mitigated at all.Rizzo and Duong have warned that this vulnerability might be even more widespread than SPDY and TLS compression combined.