NGINX released two new versions yesterday—1.30.6 on the stable branch and 1.31.7 on the mainline—to address five newly discovered vulnerabilities, one of which impacts all versions dating back to May 2005. These flaws include three memory-corruption issues capable of crashing worker processes or possibly allowing remote code execution under certain configurations. They join a TLS bug that can let attackers forge sessions to skip client-certificate verification, and an HTTP/3 issue that permits bypassing body-size limits. All are rated medium severity by NGINX, with three scoring 9.2 under CVSS v4.0 as critical. F5 assigns the TLS flaw an 8.3 rating, and the HTTP/3 issue a 6.9. None are listed in CISA’s Known Exploited Vulnerabilities as of October 15, 2026, and there are no known active exploits yet.
Configuration Conditions That Open the Door
None of the five flaws are unconditional—each requires specific module settings or directives to be exploitable. The memory issues become dangerous when using certain combinations: configurations with “alias” plus “rewrite” involving $request_filename; regex maps whose captures are referenced by root or log_format; or enabling asynchronous I/O (AIO) with Server Side Includes (SSI) involving virtual includes. The TLS vulnerability arises when using a shared session cache without loading explicit ticket keys from files. HTTP/3’s body-size bypass only applies when proxy_request_buffering is on—its default value—with HTTP/3 enabled.
Details of the Five Flaws and Affected Versions
The bugs include:
- CVE-2026-15176: Heap overflow tied to “alias” + “rewrite” + any operation involving $request_filename. Affects versions 0.1.29 through 1.31.6. Workaround: avoid those directive patterns.
- CVE-2026-93479: Heap overflow in regex map captures used by root or log_format. Affects 1.30.0–1.30.5 and 1.31.2–1.31.6. A safer approach involves named captures only used inside matching blocks.
- CVE-2026-97205: Use-after-free in situations where aio is enabled along with SSI pages using “include virtual”. Affects 0.8.11 through 1.31.6. Disable aio or avoid SSI pages until patched.
- CVE-2026-95101: Extra bytes injected into proxied requests, or bodies exceeding client_max_body_size slipping through under HTTP/3 when proxy_request_buffering is on. Same affected versions as above.
- CVE-2026-97629: TLS session bypass where a forged session could circumvent client-certificate verification. Triggered via shared ssl_session_cache without ssl_session_ticket_key. Affects versions from 1.23.2 through 1.31.6.
For users who can’t upgrade immediately, the advisory includes specific workarounds for each bug. Examples: disable aio or SSI pages to avoid use-after-free, turn off proxy_request_buffering under HTTP/3, or load your session ticket key from a file instead of using automatic key rotation.
This update is NGINX’s eighth security release in 2026. Oversights from previous fixes show up: the regex map bug CVE-2026-93479 was introduced by a change made in July’s patch for CVE-2026-42533, leaving some buffer overlaps that weren’t fully addressed until now. The HTTP/3 issue stems from parser logic misusing a field for tracking skipped frame length and remaining body bytes—this error lets bodies slip through unchecked size limits.
Businesses using NGINX, F5 tooling (like its Ingress Controller, WAF, etc.), or HTTP/3 should verify their version and configuration without delay. Run nginx -T to inspect your settings for alias+rewrite, regex map roots, aio+ssi, quic (HTTP/3), and shared ssl_session_cache without ssl_session_ticket_key. If patches are not yet available for your build, apply the listed mitigation measures.
What this means: the latest patches reinforce the risk buried in optional or default features—features many consider secondary. Vulnerabilities tied to seldom-used directives, legacy behaviors, or optional modules all highlight that even minor configuration choices can expose serious security holes. As HTTP/3 adoption grows and TLS session resumption becomes more complex, configurations once taken for granted are now under scrutiny. For organizations, this means auditing default settings and dependencies—not just upgrading versions—will be essential to staying safe.”
