NGINX released stable version 1.30.6 and mainline version 1.31.7 on October 14, 2026, fixing five vulnerabilities. The issues include three memory-safety bugs that can crash worker processes or potentially enable code execution, an HTTP/3 request-body injection flaw, and a TLS session-forgery bug that may bypass client-certificate verification. Upgrade to one of those releases, or to an operating-system package that explicitly backports the fixes.
NGINX rates all five as medium severity in its advisory. F5’s CVSS v4.0 assessments rate the three memory flaws 9.2, the TLS issue 8.3 and the HTTP/3 issue 6.9. As of October 15, none was listed in CISA’s Known Exploited Vulnerabilities catalog, and NGINX and F5 had reported no attacks involving them.
As an Amazon Associate I earn from qualifying purchases.
Which NGINX versions are affected and fixed?
| Vulnerability | Affected versions | Primary condition |
|---|---|---|
CVE-2026-15176 |
0.1.29 through 1.31.6 | alias, a URI-changing rewrite and a read of $request_filename |
CVE-2026-93479 |
1.31.2–1.31.6 and 1.30.0–1.30.5 | Regex map captures referenced by root or log_format before the map output variable |
CVE-2026-97205 |
0.8.11 through 1.31.6 | Asynchronous file I/O with SSI pages using include virtual |
CVE-2026-95101 |
1.25.0 through 1.31.6 | HTTP/3 proxying with the default proxy_request_buffering on |
CVE-2026-97629 |
1.23.2 through 1.31.6 | Shared ssl_session_cache without explicit ssl_session_ticket_key files |
The fixed targets are 1.30.6 for the stable branch and 1.31.7 for mainline. A release such as 1.28 is still exposed unless its distributor confirms that these patches were backported.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What each flaw can do
CVE-2026-15176: alias and rewrite heap overflow
A vulnerable location combines the alias directive with a rewrite that changes the URI, then reads $request_filename. That sequence can overflow a heap buffer in an NGINX worker process, resulting in a crash and possibly code execution. F5’s interim advice is to remove alias from the affected location and avoid using $request_filename there.
#1 Best Overall
CVE-2026-93479: regex map evaluation overflow
This bug is triggered when captures from a regular-expression map are consumed by root or log_format before the map’s output variable has been evaluated. The resulting heap overflow can corrupt worker memory. Until upgrading, use named captures only inside the regex-match block rather than exposing captures to those directives.
CVE-2026-97205: AIO and SSI use-after-free
When asynchronous file I/O (aio) serves SSI content containing include virtual, pending operations can outlive the request memory they reference. That use-after-free can cause a crash or memory corruption and may permit code execution if Address Space Layout Randomization (ASLR) is disabled or bypassed. Disable aio or stop serving SSI pages until the patched build is deployed.
Rank #2
CVE-2026-95101: HTTP/3 request-body injection
With HTTP/3 enabled and the default proxy_request_buffering on, an unknown frame split across reads may be interpreted as request-body data and forwarded to an upstream server without being constrained by client_max_body_size. The cited workaround is proxy_request_buffering off for the affected proxy configuration.
CVE-2026-97629: TLS session forgery
A shared ssl_session_cache normally causes NGINX to rotate session-ticket keys automatically when no explicit key files are configured. In this flaw, uninitialized key material can make a forged TLS session possible in a non-deterministic way. An attacker could then bypass client-certificate verification and reach protected resources. Deployments with ssl_session_tickets off are not affected. Other mitigations are removing the shared cache, loading explicit ssl_session_ticket_key files, or disabling session tickets.
How to check a server before upgrading
- Run
nginx -Twith the same privileges and configuration path used by the service, and save the effective configuration for review. - Search for locations that combine
alias, URI-changing rewrites and$request_filename. - Review every regex
mapfor captures referenced byrootorlog_formatbefore the map output variable. - Inventory
aioand SSI usage, especially pages containinginclude virtual. - Identify HTTP/3 or QUIC listeners and the proxy locations behind them; check whether
proxy_request_bufferingremains enabled. - Inspect TLS servers for a shared
ssl_session_cachewithout explicitssl_session_ticket_keyfiles, and verify whether mutual TLS protects sensitive endpoints.
What to do if patching is delayed
- Remove the vulnerable
alias/$request_filenamecombination. - Constrain regex-map captures to the matching block and do not use them prematurely in
rootorlog_format. - Turn off
aioor disable SSI pages that use virtual includes. - Set
proxy_request_buffering offon HTTP/3 proxy paths. - Remove the shared TLS session cache, provide explicit ticket-key files, or set
ssl_session_tickets off. - After changing settings, run
nginx -t, reload the service using the normal operating-system procedure, and confirm that the intended listeners and authentication paths still work.
Verification after the upgrade
Re-run nginx -T and confirm the binary reports 1.30.6 or 1.31.7, or obtain written confirmation from the package distributor that the fixes are backported. Test mutual-TLS login and authorization flows specifically, because the TLS issue concerns possible client-certificate bypass. Also exercise HTTP/3 uploads, SSI pages and any rewritten aliased locations to catch configuration regressions.
One earlier NGINX rewrite-module issue, CVE-2026-42945, was reported as exploited within days of disclosure in May 2026. It is separate from these five October vulnerabilities and does not change their affected-version ranges.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
