News Vulnerabilities & Zero-Days

NGINX 1.30.6 and 1.31.7 fix five flaws, including memory bugs and a TLS session forgery issue

NGINX released 1.30.6 and 1.31.7 on 14 October 2026 to fix five vulnerabilities, including heap overflows and a use-after-free that F5 says could allow code execution under specific configurations, and a TLS flaw that may skip client certificate checks.

Published Updated
Illustration of a web server traffic hub with five glowing patch plates fitted over cracks in its routing pipes.

Key takeaways

  • NGINX 1.30.6 and 1.31.7 fix five vulnerabilities, all tied to specific configurations.
  • F5 scores three memory bugs 9.2 and says they could allow code execution.
  • A TLS flaw may let a forged session skip client certificate checks.
  • Only the 1.30 and 1.31 branches get fixes; older branches stay vulnerable.
  • No exploitation had been reported as of 15 October 2026.

NGINX released 1.30.6 (stable) and 1.31.7 (mainline) on 14 October 2026, fixing five vulnerabilities. NGINX rates all five medium, while F5, which owns NGINX, scores three of them 9.2 (Critical) on CVSS 4.0, The Hacker News reported. Each flaw only applies with particular configuration, so check yours against the table below.

Which flaws were fixed? #

CVE What it is Affected versions Exposing configuration
CVE-2026-15176 Buffer overflow with alias and rewrite 0.1.29 to 1.31.6 alias in a location, a rewrite that changes the URI, and use of $request_filename
CVE-2026-93479 Buffer overflow in script evaluation 1.30.0 to 1.30.5, 1.31.2 to 1.31.6 Regex map captures used by root or log_format
CVE-2026-97205 Use-after-free with asynchronous file I/O 0.8.11 to 1.31.6 aio enabled with SSI include virtual
CVE-2026-95101 Request body injection in HTTP/3 1.25.0 to 1.31.6 HTTP/3 with proxy_request_buffering on, the default
CVE-2026-97629 TLS session forgery 1.23.2 to 1.31.6 ssl_session_cache shared: without ssl_session_ticket_key

Affected and fixed versions are from NGINX's security advisories page. Configuration details are from F5's advisories, as reported by The Hacker News.

How serious are they? #

F5 says the three memory bugs can crash a worker process and could lead to code execution, The Hacker News reported. The TLS flaw could let a forged session bypass client certificate verification, though F5 describes it as non-deterministic and outside attacker control. The HTTP/3 flaw can inject extra bytes into a proxied request or let a body exceed client_max_body_size.

None of the five was in CISA's Known Exploited Vulnerabilities catalog as of 15 October, and neither NGINX nor F5 reports attacks.

What should NGINX operators do? #

  1. Upgrade to 1.30.6 or 1.31.7. Only these two branches receive fixes; older branches such as 1.28 stay vulnerable.
  2. If you use distribution packages, confirm your distributor has backported the patches.
  3. NGINX Plus and F5 products built on NGINX, such as Ingress Controller, need checking against F5's own advisories.
  4. Until you can upgrade, review your configuration with nginx -T for the patterns in the table. F5's workarounds include turning aio off where SSI is used, setting proxy_request_buffering off for HTTP/3, and loading TLS ticket keys from a file with ssl_session_ticket_key.

Sources

  1. NGINX security advisories, NGINX

Questions this raises

Why does NGINX rate them medium while F5 scores some 9.2?
The two organizations use different scales. Each flaw also needs a specific configuration, which lowers real-world exposure for many servers.
Is NGINX Plus affected?
NGINX Plus customers should check F5's advisories for affected builds. The Hacker News reported no specific Plus build numbers.
Is it being exploited?
Neither NGINX nor F5 reported attacks, and none of the five was in CISA's KEV catalog as of 15 October 2026.

VulnerabilitySecurity UpdateOpen Source SecurityNetwork SecurityNGINX