NGINX Patches Five Flaws: Three Memory Bugs, a TLS Client-Cert Bypass and an HTTP/3 Smuggling Issue
On October 14, 2026, NGINX shipped 1.30.6 (stable) and 1.31.7 (mainline), closing five vulnerabilities. Three are memory-safety bugs that can crash a worker process and, in F5's assessment, could potentially lead to code execution. A fourth can, under narrow conditions, let a forged TLS session slip past client-certificate verification. The fifth lets an HTTP/3 client push extra bytes through to a backend. One of the affected code paths dates back to releases from 2005.
The good news: none of the five is triggered by a default install. Each one depends on a specific directive or combination of directives an administrator has turned on. The less good news: some of those directives are common — including one that NGINX's own documentation uses as an example.
What happened
| CVE | Impact | You're exposed if… | Affected | Stop-gap if you can't upgrade |
|---|---|---|---|---|
| CVE-2026-15176 | Heap overflow → worker crash, possible RCE | A location uses alias, a rewrite changes the URI, and something reads $request_filename (e.g. return, set, if, add_header, log format) | 0.1.29 – 1.31.6 | Drop alias in that location, or stop referencing $request_filename |
| CVE-2026-93479 | Heap overflow → worker crash, possible RCE | A regex map whose captures are used by root or log_format before the map's output variable | 1.30.0 – 1.30.5, 1.31.2 – 1.31.6 | Use named captures, scoped to the block containing the regex match |
| CVE-2026-97205 | Use-after-free → crash / memory corruption, possible RCE | aio on and SSI pages using include virtual (in some configs) | 0.8.11 – 1.31.6 | Disable aio, or stop serving SSI |
| CVE-2026-95101 | Extra bytes injected into a proxied request; body can exceed client_max_body_size | HTTP/3 with proxy_request_buffering on (the default) | 1.25.0 – 1.31.6 | proxy_request_buffering off |
| CVE-2026-97629 | Forged TLS session may bypass client-cert verification | ssl_session_cache shared:… without ssl_session_ticket_key (auto key rotation) | 1.23.2 – 1.31.6 | Load ticket keys from a file, drop the shared cache, or set ssl_session_tickets off |
Severity, as rated by the vendor: NGINX labels all five medium. F5's CVSS v4.0 scores are higher — 9.2 (Critical) for the three memory bugs, 8.3 for the TLS issue and 6.9 for HTTP/3. As of October 15, none was listed in CISA's KEV catalog and neither NGINX nor F5 reported in-the-wild exploitation.
The TLS ticket-key bug, briefly
Since 1.23.2 (October 2022), a shared session cache without an explicit key file makes NGINX generate and rotate session-ticket keys on its own. Each worker holds three key slots, but rotation only refreshed two — leaving the third holding uninitialized memory. A ticket that pointed at that slot could be validated against it. F5 stresses the forgery is non-deterministic and outside the attacker's control, so treat it as a real but hard-to-hit risk — not a reliable bypass. It echoes CVE-2025-23419, a session-reuse issue with the same outcome fixed in February 2025.
The regex map bug is a regression
CVE-2026-93479 lives in the same string-handling code NGINX patched in July for CVE-2026-42533. A July change let data spill into a reserved area, and a follow-up patch then sized the final string from that spilled length. Practical takeaway: a server patched in July — or one relying on July's named-captures workaround alone — is still in the affected range. Upgrading is the only complete fix.
The other three
- alias + rewrite: in the window after a
rewritechanges the URI but before the next location is picked, reading$request_filenamewith a location prefix longer than the new URI overflows a buffer during path mapping. - AIO + SSI: an unchecked 8-bit counter of pending async operations wraps at 256, so the request can be freed while operations still reference it. Parallel
include virtualsubrequests are the trigger. - HTTP/3: one parser field tracked both "bytes left to skip in an unknown frame" and "DATA bytes to forward". An unknown frame split across reads made the leftover count be forwarded as body — bypassing the size limit.
Why it matters
NGINX sits in front of a huge share of the web, often as a reverse proxy or TLS terminator for apps that never see the raw connection. Memory bugs in the worker process mean crash-level DoS at minimum. The TLS issue goes to the heart of mTLS deployments: if client certificates are your access control, a session-resumption weakness is an authorization problem, not just a crypto footnote. Context also matters: a rewrite-module overflow NGINX fixed in May 2026 (CVE-2026-42945) was reportedly exploited within days of disclosure. This is NGINX's eighth security release of 2026.
What to do
- Upgrade to 1.30.6 (stable) or 1.31.7 (mainline). Only those two branches receive fixes — 1.28 and older stay vulnerable. For distro packages, confirm your vendor has backported the patches; a version number alone won't tell you.
- NGINX Plus, Ingress Controller, Gateway Fabric, Instance Manager and NGINX App Protect WAF users: check F5's advisories. Several products had no fixed build as of October 15.
- Audit your running config with
nginx -Tand look for:aliasin a location alongsiderewrite- regex
mapcaptures used byrootorlog_format aiotogether withssilisten … quic(HTTP/3)ssl_session_cache sharedwithoutssl_session_ticket_key
- If you can't upgrade yet, apply the per-CVE stop-gaps in the table above — prioritising the TLS fix on any mTLS endpoint.
- Inventory your NGINX estate, including containers, ingress controllers and appliances that embed it; these are the places old versions hide.
- Also update njs to 1.0.2, released the same day to fix two medium-severity XML-handling flaws (CVE-2026-101025, CVE-2026-101019).
4Tify's external assessments flag outdated NGINX versions and risky TLS configurations as part of tech-stack CVE coverage.
Source: originally reported by The Hacker News; this article is 4Tify's independent summary and analysis.