What dropped on October 14

NGINX pushed 1.31.7 (mainline) and 1.30.6 (stable) with fixes for five flaws, all rated medium by F5's security advisories:

  • CVE-2026-15176 — buffer overflow when alias meets rewrite in the same location (vulnerable: 0.1.29–1.31.6)
  • CVE-2026-93479 — buffer overflow in script evaluation when regex captures are referenced the wrong way (vulnerable: 1.30.0–1.30.5, 1.31.2–1.31.6)
  • CVE-2026-95101 — request body injection in HTTP/3: a crafted frame can smuggle bytes past client_max_body_size to the backend (vulnerable: 1.25.0–1.31.6)
  • CVE-2026-97629 — TLS session ticket forgery that can bypass client-certificate checks (vulnerable: 1.23.2–1.31.6)
  • CVE-2026-97205 — use-after-free when async file I/O meets Server Side Includes (vulnerable: 0.8.11–1.31.6)

This is NGINX's eighth security release of 2026. F5 reports no active exploitation of these five — yet. But the pattern is familiar: in May, a similar rewrite-module overflow (CVE-2026-42945) was being exploited within days of disclosure. "Medium" is not "ignore it."

The detail everyone misses: your version isn't the whole story

Four of the five flaws only trigger under specific configuration patterns. A vulnerable version running a config that never touches those paths isn't exploitable through these CVEs — so the operator's first move isn't the version string, it's the running config. Dump it all, including every include file:

TEXT
nginx -T

Then grep the dump for the trigger patterns:

  • alias sitting in a location next to a rewrite — CVE-2026-15176
  • unnamed regex captures referenced by root or log_format outside the matching block — CVE-2026-93479
  • aio enabled together with ssi, on pages using include virtual — CVE-2026-97205
  • listen lines with quic — CVE-2026-95101
  • ssl_session_cache shared without rotating ssl_session_ticket_key — CVE-2026-97629

Presence of a vulnerable version alone doesn't prove exposure. Presence of the version plus the pattern does.

Archaeology: bugs that outlived their distros

Two of the five flaws are ancient by software standards. CVE-2026-15176 is listed as vulnerable from 0.1.29 — the mid-2000s, before most of today's servers were even provisioned. CVE-2026-97205 reaches back to 0.8.11, the late 2000s. Those code paths survived two decades of releases, refactors, and renames without anyone tripping over them.

The uncomfortable lesson: "battle-tested" and "bug-free" aren't synonyms. The quiet, never-touched code path is exactly where the next memory-safety bug lives — and in a reverse proxy that sits in front of everything, one corrupted worker process is one request away from becoming a crash, or worse.

The patch playbook

  1. Check what you're actually running. nginx -v gives the build version — but your distro package may already have backports. Cross-check the distro's security tracker (Debian, Ubuntu, RHEL all publish CVE-to-package mappings) before assuming you're exposed.
  2. Pick your branch deliberately. Stable users want 1.30.6 — it contains only fixes, no new behavior. Mainline users go to 1.31.7. Note that NGINX only publishes fixes for these two branches: older ones like 1.28 stay inside the affected ranges unless your distribution backports the patches itself.
  3. Reload, don't restart. After upgrading or changing config, validate with nginx -t, then nginx -s reload. A graceful reload keeps existing connections alive; a full restart drops them — exactly the kind of self-inflicted downtime that makes patching feel scarier than the bug.
  4. If you can't patch today, F5's advisories carry per-flaw workarounds: disable aio or ssi (CVE-2026-97205), avoid alias inside location blocks in favor of root plus rewrite (CVE-2026-15176), switch unnamed regex captures to named ones used only inside the matching block (CVE-2026-93479). These cover the known trigger paths — the upgrade remains the real fix.
  5. Watch the error log. Several of these flaws manifest as worker process crashes. A sudden run of worker process exited lines in your error log is the fingerprint of someone probing — treat it as a signal to patch faster, not just noise.

Don't forget njs

The same day, NGINX also shipped njs 1.0.2, fixing two medium-severity XML-handling flaws (CVE-2026-101025, CVE-2026-101019) in its embedded JavaScript module. If your config loads njs — and plenty of API-gateway setups do — that's a second package to bump in the same maintenance window.

Sources

  • NGINX security advisories (official): http://nginx.org/en/security_advisories.html
  • The Hacker News — NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks: http://thehackernews.com/2026/10/nginx-fixes-5-flaws-including-possible.html