NGINX shipped 1.30.6 on the stable branch and 1.31.7 on mainline on 14 October 2026, closing five vulnerabilities at once. Three are memory-safety bugs that F5 scores 9.2 Critical under CVSS v4.0. A fourth lets an attacker forge a TLS session ticket and, in F5's assessment, potentially slip past client-certificate verification. The fifth lets an HTTP/3 client push bytes into a proxied request that no size check counted. NGINX itself rates all five medium, and neither the maintainers nor F5 reported exploitation as of 15 October.

The reason this release matters is not the count. It is that every one of the five requires a directive that an operator chose to enable. A default installation of the affected versions is not automatically exploitable by any of them, and a hardened configuration may already be immune. The useful work for most teams is therefore two-part: upgrade, and then confirm what your running configuration actually contains.

What the five flaws do

CVE-2026-15176 is a heap overflow in the request-handling path. A location that combines alias with a rewrite that changes the URI, plus anything that reads $request_filename in the window between the rewrite and the next location selection, can overflow a buffer. F5 credits the discovery to its own engineers. The affected range starts at 0.1.29, which makes this the flaw that has been present in essentially every NGINX release since May 2005.

CVE-2026-93479 is a second heap overflow, this one in string handling. A regex map whose captures are referenced by root or log_format before the map's output variable can overrun a buffer sized from a spilled length. The affected branches are 1.30.0 through 1.30.5 and 1.31.2 through 1.31.6, and the bug traces directly to the July patch for CVE-2026-42533.

CVE-2026-97205 is a use-after-free in worker processes. It needs aio enabled together with SSI pages that use include virtual commands, where included requests can run in parallel. Each pending asynchronous operation increments an 8-bit counter without a bound; at 256 pending operations the counter wraps to zero and the request can be freed while those operations still reference its memory.

CVE-2026-95101 is a parser bug in HTTP/3. One field did two jobs, holding both the remaining length of an unknown frame being skipped and the DATA byte count to pass through as request body. When an unknown frame arrived split across two reads, the leftover count was treated as body and forwarded to the backend outside the client_max_body_size check. It requires HTTP/3 plus proxy_request_buffering left at its default of on.

CVE-2026-97629 is the TLS problem. Since 1.23.2, an ssl_session_cache shared:... directive without ssl_session_ticket_key makes NGINX generate and rotate ticket keys itself. Each worker keeps three key slots; rotation copied only two, so the third held whatever was previously in memory. A ticket naming that slot could be verified with uninitialized key material, which is what F5 describes as a forged session, achieved in a non-deterministic manner beyond the attacker's control and usable to bypass client-certificate checks.

Affected scope

Stable and mainline are the only branches NGINX still patches. The published ranges mean that a server sitting on an older branch, including 1.28, stays inside an affected range indefinitely, and that a distribution package is only fixed if the distribution backported the patches. NGINX Plus customers, and users of F5's Ingress Controller, Gateway Fabric, Instance Manager and WAF products, need to read the separate F5 advisories, several of which listed no fixed build as of 15 October.

Remediation

The direct fix is 1.30.6 on stable or 1.31.7 on mainline.

Where an upgrade has to wait, each flaw has a targeted workaround: avoid alias in a location that rewrites, or stop reading $request_filename there; use named captures and keep them inside the block containing the regex match; disable aio or stop serving SSI pages; set proxy_request_buffering off; and either remove the shared session cache directive or supply keys explicitly with ssl_session_ticket_key, noting that servers with ssl_session_tickets off were never affected.

Self-check

Print the running configuration with nginx -T and search it for the five triggers: alias beside a rewrite in the same location, a regex map used by root or log_format, aio together with ssi, a listen line carrying quic, and ssl_session_cache shared without ssl_session_ticket_key. Any hit is a configuration worth reviewing before the release window closes.

Sources

  • NGINX security advisories: https://nginx.org/en/security_advisories.html

  • F5 advisory K000162416 (alias): https://my.f5.com/manage/s/article/K000162416

  • F5 advisory K000162607 (map): https://my.f5.com/manage/s/article/K000162607

  • F5 advisory K000162608 (AIO/SSI): https://my.f5.com/manage/s/article/K000162608

  • F5 advisory K000162613 (HTTP/3): https://my.f5.com/manage/s/article/K000162613

  • F5 advisory K000162606 (TLS tickets): https://my.f5.com/manage/s/article/K000162606

  • NGINX downloads: https://nginx.org/en/download.html