Five NGINX vulnerabilities fixed in 1.30.6 and 1.31.7
Five NGINX vulnerabilities affecting particular web server configurations have been fixed in stable version 1.30.6 and mainline version 1.31.7. NGINX released both updates on October 14. Three flaws can corrupt memory, crash a worker process and potentially allow remote code execution (RCE), meaning an attacker might run software on the server. Another could forge a Transport Layer Security (TLS) session and bypass client-certificate verification, while the fifth can place unintended data into an HTTP/3 request sent to a backend application.
NGINX classifies all five vulnerabilities as medium severity. F5, the company behind NGINX, assigned the three memory flaws a 9.2 Critical score under the Common Vulnerability Scoring System version 4.0. It scored the TLS issue 8.3 and the HTTP/3 problem 6.9. As of October 15, none appeared in the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog, and neither NGINX nor F5 had reported attacks involving them. One flaw affects releases dating back to May 2005, but every vulnerability requires a specific configuration rather than exposing every NGINX installation by default.
CVE-2026-15176 affects versions 0.1.29 through 1.31.6. It can cause a heap overflow when a location uses alias, a rewrite changes the request's URI, and a directive such as return, set, if, add_header or the access log reads $request_filename before NGINX selects the next location. If that location's prefix is longer than the rewritten URI, converting the URI into a file path can exceed its memory buffer. F5 recommends avoiding alias in that location and not using $request_filename until an upgrade is possible.
CVE-2026-93479 is another heap overflow, reached through a regular-expression map whose captured values are used by root or log_format before the map's output variable. Versions 1.30.0 through 1.30.5 and 1.31.2 through 1.31.6 are listed as affected. The vulnerable string handling had previously been changed for CVE-2026-42533, which NGINX patched on July 15. According to the later fix, one July change prevented a buffer overrun but still allowed data to enter reserved space, while another calculated the final string size from that excess length. The newly fixed overflow was limited to the reserved area on the document-root path and to one null byte on the access-log path. Although the listed affected versions begin before the July change, any server updated with the July release remains within the affected ranges. F5's temporary advice is to use named captures only inside the block containing the matching expression, although a researcher told The Hacker News in July that upgrading was the only complete resolution to the earlier issue.
CVE-2026-97205 is a use-after-free vulnerability affecting versions 0.8.11 through 1.31.6 when asynchronous input and output (AIO) is enabled and Server Side Includes (SSI) pages use include virtual commands in certain configurations. Each unfinished asynchronous operation adds to an 8-bit counter. At 256 pending operations, the counter returns to zero, allowing a request to be freed while operations still refer to its memory. The result can be a crash, memory corruption or possible code execution. Administrators unable to update can turn off AIO or stop serving SSI pages.
CVE-2026-95101 affects HTTP/3 deployments running versions 1.25.0 through 1.31.6 with proxy_request_buffering enabled, which is the default. A parser field was used both to track the remaining size of an unknown frame being skipped and to count request-body bytes. If that frame arrived across two reads, NGINX could treat the remaining count as body data and forward extra bytes to the backend, outside the client_max_body_size check. F5's workaround is to set proxy_request_buffering off. NGINX documentation ordinarily recommends request buffering, making it important for HTTP/3 operators to install the fixed release rather than leave the workaround in place indefinitely.
CVE-2026-97629 affects versions 1.23.2 through 1.31.6 when ssl_session_cache uses a shared cache and no ssl_session_ticket_key file is configured. Since version 1.23.2 in October 2022, that combination makes NGINX automatically create and rotate TLS session ticket keys. Each worker retains three key slots, but rotation copied only two of them. The third could therefore contain uninitialized memory, and a ticket referring to that slot could be checked and decrypted with those unintended contents. F5 says the resulting session forgery is non-deterministic and beyond an attacker's control, but it could bypass client-certificate verification. The shared-cache configuration appears in NGINX's own documentation. Sites that cannot update can remove the shared cache, supply ticket keys through ssl_session_ticket_key, or turn ssl_session_tickets off. NGINX fixed an earlier session-reuse issue with the same potential certificate-check bypass, CVE-2025-23419, in February 2025.
Administrators should install 1.30.6 on the stable branch or 1.31.7 on mainline. The stable release contains fixes only. NGINX publishes security corrections for those two branches, so older branches such as 1.28 remain within affected ranges unless a Linux distribution has backported the patches into its package. NGINX Plus users and operators of F5 Ingress Controller, Gateway Fabric, Instance Manager or WAF products should consult F5's product advisories. Those advisories listed affected builds and, for several products, no fixed build as of October 15.
A practical review starts by printing the active configuration with nginx -T and checking for alias combined with rewrite, regular-expression maps used by root or log_format, aio alongside ssi, listen directives using quic, and a shared ssl_session_cache without ssl_session_ticket_key. Managed customers who cannot inspect this themselves should ask their hosting provider to confirm the installed NGINX release and whether patches were backported. For WordPress website owners considering managed operations, AEU Hosting offers managed WordPress hosting, secured end to end.
This was NGINX's eighth security release of 2026. The urgency is reinforced by a separate rewrite-module overflow, CVE-2026-42945, which VulnCheck found was being exploited within days of its disclosure after NGINX patched it in May. F5 found the alias flaw and attributed other reports to researchers affiliated with Tolmo and GOTROOT, PhiNode Labs, and another researcher. On the same day, NGINX also released njs 1.0.2 to correct two medium-severity XML-handling vulnerabilities, CVE-2026-101025 and CVE-2026-101019.