NGINX fixes five flaws, including possible code execution and TLS client-cert bypass

NGINX on October 14, 2026 released versions 1.30.6 (stable) and 1.31.7 (mainline) to fix five vulnerabilities, including three memory-safety bugs that F5 rates 9.2 under CVSS v4.0 and that could allow code execution in worker processes, according to The Hacker News. The publication describes the update as NGINX's eighth security release of 2026. NGINX's own project ratings classify all five issues as medium, the report notes.

What happened

The Hacker News reports that CVE-2026-15176, found internally by F5, is a heap overflow triggered when alias is combined with a URI-changing rewrite and something reads $request_filename before the next location is selected. It affects versions from 0.1.29 through 1.31.6.

CVE-2026-93479 is a heap overflow involving regex map captures used by root or log_format. According to the publication, it stems from string-handling code NGINX patched in July for CVE-2026-42533, meaning servers updated in July can still be in the affected range.

CVE-2026-97205 is a use-after-free in the asynchronous I/O (aio) path when serving SSI pages with include virtual. The Hacker News explains that an 8-bit counter of pending operations could wrap around after 256 operations, allowing a request to be freed while still in use.

Technical details

The fourth issue, CVE-2026-97629 (CVSS 8.3), affects servers using ssl_session_cache shared: without an explicit ssl_session_ticket_key. Per the report, automatic ticket key rotation copied only two of three key slots, so a ticket referencing the third could be verified with uninitialized key material. F5 describes the forgery as non-deterministic and outside the attacker's control, but says it could bypass client-certificate verification.

The fifth, CVE-2026-95101 (CVSS 6.9), affects HTTP/3 with proxy_request_buffering on, where extra bytes could be injected into proxied requests and bodies could exceed client_max_body_size.

None of the flaws were in CISA's Known Exploited Vulnerabilities catalog as of October 15, and neither NGINX nor F5 reported attacks, The Hacker News said. NGINX also released njs 1.0.2 the same day, fixing two medium-severity XML handling issues.

What to do

• Upgrade to NGINX 1.30.6 or 1.31.7. Older branches such as 1.28 are not fixed, and distribution packages are safe only if maintainers backport the patches.
• NGINX Plus users should check F5's advisories; The Hacker News said fixed builds were not yet available for several products, including F5's Ingress Controller, Gateway Fabric, Instance Manager and WAF.
• If upgrading is not immediately possible, F5's workarounds include avoiding alias with $request_filename, using named captures in regex maps, turning off aio or SSI, setting ssl_session_ticket_key or disabling the shared cache, and setting proxy_request_buffering off for HTTP/3.
• Run nginx -T to review the full configuration for the affected directive combinations.