{
  "id": "nginx-oct-2026",
  "url": "https://ohshit.app/incidents/nginx-oct-2026/",
  "title": "nginx 1.30.6 and 1.31.7 fix five worker-process bugs: three heap overflows/UAF, HTTP/3 body injection, forged TLS sessions",
  "level": 3,
  "level_name": "sharted",
  "date": "2026-10-14",
  "date_is_approximate": false,
  "updated": null,
  "tags": [
    "nginx",
    "F5",
    "HTTP/3",
    "TLS",
    "memory corruption"
  ],
  "ecosystems": [],
  "summary": "nginx.org rates all five Medium, but F5's CVE records score three memory-corruption bugs at CVSS 8.1. Each needs a specific config: alias plus rewrite, regex map captures, AIO with SSI, HTTP/3, or rotated TLS session tickets. No exploitation reported.",
  "splash": "nginx Open Source before 1.30.6 / 1.31.7, NGINX Plus R33 to 37.x, and products that bundle them",
  "wipe": "Upgrade to nginx 1.30.6 (stable) or 1.31.7+ (mainline), or the F5 hotfix for NGINX Plus, then reload",
  "in_the_wild": "no",
  "source_exception": null,
  "cves": [
    {
      "id": "CVE-2026-15176",
      "score": 8.1,
      "name": "Buffer overflow with alias and rewrite",
      "description": "Heap overflow in a worker when a location uses alias, the URI was changed by rewrite, and $request_filename is used (in set, return or an access log format). Affects 0.1.29 to 1.31.6.",
      "plain": "a very old pipe that only bursts if you plumbed it one specific way."
    },
    {
      "id": "CVE-2026-93479",
      "score": 8.1,
      "name": "Buffer overflow evaluating variables",
      "description": "Heap overflow when string expressions with variables are evaluated, e.g. a regex map whose capture variables are used in root or a log format before the map's own output. Affects 1.30.0 to 1.30.5 and 1.31.2 to 1.31.6."
    },
    {
      "id": "CVE-2026-95101",
      "score": 5.3,
      "name": "HTTP/3 request body injection",
      "description": "Part of an unknown HTTP/3 frame can be treated as request body, bypassing client_max_body_size or injecting data into the proxied request. Affects 1.25.0 to 1.31.6.",
      "plain": "someone slips an extra note into the envelope after you sealed it."
    },
    {
      "id": "CVE-2026-97629",
      "score": 6.5,
      "name": "TLS session forgery with ticket key rotation",
      "description": "With a shared ssl_session_cache and no ssl_session_ticket_key file, one auto-rotated ticket key is left uninitialised, so a session can sometimes be forged, which can skip client certificate checks. Affects 1.23.2 to 1.31.6."
    },
    {
      "id": "CVE-2026-97205",
      "score": 8.1,
      "name": "Use-after-free with AIO and SSI",
      "description": "With aio enabled in some configurations, an SSI page using \"include virtual\" can trigger a use-after-free in a worker."
    }
  ],
  "fixed": [
    {
      "product": "nginx mainline 1.31.x",
      "branch": "1.31",
      "version": "1.31.7",
      "status": "Mainline"
    },
    {
      "product": "nginx stable 1.30.x",
      "branch": "1.30",
      "version": "1.30.6",
      "status": "Stable"
    },
    {
      "product": "nginx 1.28 and older",
      "branch": "*",
      "version": "none",
      "status": "Unsupported, upgrade to 1.30.6+"
    }
  ],
  "checklist": [
    {
      "title": "Find every nginx you run",
      "hint": "nginx -v on hosts, Docker base images, ingress controllers, appliances that bundle it"
    },
    {
      "title": "Upgrade to 1.30.6 or 1.31.7+",
      "hint": "Distro packages may backport instead; check your vendor's CVE tracker, not just the version string"
    },
    {
      "title": "Grep your config for the risky features",
      "hint": "alias with rewrite, $request_filename, map with regex, aio, ssi on, listen ... quic, ssl_session_cache shared"
    },
    {
      "title": "Pin session ticket keys or disable tickets",
      "hint": "Also stops ticket keys drifting between workers and hosts"
    },
    {
      "title": "Patch NGINX Plus and F5 products too",
      "hint": "Use the hotfix versions in the F5 K-articles"
    }
  ],
  "sources": [
    {
      "name": "nginx security advisories",
      "url": "https://nginx.org/en/security_advisories.html",
      "says": "All five rated \"medium\"; lists vulnerable and not-vulnerable versions per CVE",
      "primary": true
    },
    {
      "name": "nginx CHANGES-1.30",
      "url": "https://nginx.org/en/CHANGES-1.30",
      "says": "1.30.6 changelog dated 14 Oct 2026 with the five security entries and credits",
      "primary": true
    },
    {
      "name": "nginx.org news",
      "url": "https://nginx.org/",
      "says": "Announces 1.30.6 and 1.31.7 on 2026-10-14",
      "primary": true
    },
    {
      "name": "CVE-2026-15176 (F5 CNA record)",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15176",
      "says": "CVSS 3.1 8.1 / 4.0 9.2; DoS, code execution only if ASLR is off or bypassed",
      "primary": true
    },
    {
      "name": "CVE-2026-93479 (F5 CNA record)",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-93479",
      "says": "CVSS 3.1 8.1; regex map capture variables in root or log format",
      "primary": true
    },
    {
      "name": "CVE-2026-95101 (F5 CNA record)",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-95101",
      "says": "CVSS 3.1 5.3; workaround proxy_request_buffering off",
      "primary": true
    },
    {
      "name": "CVE-2026-97629 (F5 CNA record)",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-97629",
      "says": "CVSS 3.1 6.5; not affected with ssl_session_tickets off or a static ticket key file",
      "primary": true
    },
    {
      "name": "CVE-2026-97205 (F5 CNA record)",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-97205",
      "says": "CVSS 3.1 8.1; lists only 1.30.0+ as affected, while nginx.org says 0.8.11+",
      "primary": true
    },
    {
      "name": "F5 K000162416 (CVE-2026-15176)",
      "url": "https://my.f5.com/manage/s/article/K000162416",
      "says": "F5 advisory; sibling K-articles K000162607, K000162613, K000162606, K000162608",
      "primary": true
    },
    {
      "name": "Canadian Centre for Cyber Security AV26-1049",
      "url": "https://cyber.gc.ca/en/alerts-advisories/f5-security-advisory-av26-1049",
      "says": "Government summary of the F5 advisory batch, dated Oct 15, 2026",
      "primary": false
    }
  ],
  "headline": "nginx: five 'medium' bugs, three of them scored 8.1 by F5",
  "one_liner": "If your config uses one of a handful of features in a particular way, a crafted request can make an nginx worker write past a buffer or use freed memory and crash, or let an attacker smuggle extra bytes into an HTTP/3 request body or resume a TLS session they never had.",
  "in_the_wild_note": "No exploitation or public PoC reported; CISA SSVC says exploitation none",
  "mitigation": {
    "file": "nginx.conf",
    "code": "# CVE-2026-97629: pin ticket keys (or turn tickets off)\nssl_session_ticket_key /etc/nginx/ticket.key;\n# ssl_session_tickets off;\n\n# CVE-2026-97205: no AIO where SSI pages are served\naio off;\n\n# CVE-2026-95101: on HTTP/3 servers\nproxy_request_buffering off;\n",
    "note": "Each line covers one CVE only, and the two buffer overflows have no switch: you would have to stop using alias/$request_filename or unnamed regex captures. Upgrading is the real fix."
  },
  "timeline": [
    {
      "date": "Sep 15, 2026",
      "title": "nginx 1.30.5 / 1.31.6 fix an HTTP/3 heap overflow",
      "body": "CVE-2026-90439, a separate earlier release; not part of this batch."
    },
    {
      "date": "Oct 14, 2026",
      "title": "nginx 1.30.6 (stable) and 1.31.7 (mainline) released with five security fixes",
      "body": "F5 publishes K-articles and CVE records the same day, plus NGINX Plus hotfixes."
    },
    {
      "date": "Oct 15, 2026",
      "title": "Canadian Cyber Centre publishes advisory AV26-1049"
    },
    {
      "date": "Oct 21, 2026",
      "title": "nginx 1.31.8 mainline released",
      "body": "Newer than the fix, so it also contains it."
    }
  ],
  "body_markdown": "On October 14, 2026, nginx shipped **1.30.6 (stable)** and **1.31.7 (mainline)** with five security fixes.\nF5 published matching advisories and CVE records the same day. The bugs live in the worker process, so the\ncontrol plane is not exposed. None of them hits a default build with a default config: each needs a\nparticular feature switched on, or switched on in a particular way.\n\n## Who said what about severity\n\nnginx.org rates **all five \"medium\"**. F5's CVE records give three of them **CVSS 3.1 8.1** (CVSS 4.0 9.2):\nthe alias/rewrite overflow, the variable-evaluation overflow and the AIO/SSI use-after-free. The high\nscores come from the possibility of code execution. F5 says that only works where ASLR is disabled or can\nbe bypassed; otherwise the result is a crashed and restarted worker. The attack complexity is rated high\nbecause the attacker can't choose the server's config. Some news summaries call these \"critical\" because of\nthe 9.2 CVSS 4.0 score; the vendor's own label is medium.\n\n## Which configs are in scope\n\n- **CVE-2026-15176**: `alias` in a location, plus `rewrite`, plus `$request_filename` used in `set`, `return`\n  or a log format. This one goes back to 0.1.29, so it reaches very old installs too.\n- **CVE-2026-93479**: a `map` with regex captures where the capture variables are used in `root` or a log\n  format. Introduced in 1.30.0 / 1.31.2. F5 suggests named captures as a workaround.\n- **CVE-2026-95101**: HTTP/3 only. The HTTP/3 module isn't built by default from source and needs a\n  `listen ... quic` socket, but it ships in many packaged builds.\n- **CVE-2026-97629**: `ssl_session_cache shared:...` without an `ssl_session_ticket_key` file, which is a common\n  setup (tickets are on by default). The forgery doesn't always work, but it can get past client certificate\n  checks, which matters if you use mTLS for auth.\n- **CVE-2026-97205**: `aio` (off by default) together with SSI pages that use `include virtual`. nginx.org\n  lists versions back to 0.8.11 as vulnerable; F5's CVE record lists only 1.30.0 and later. We go with\n  nginx.org for the open-source ranges.\n\nThe earlier HTTP/3 heap overflow (CVE-2026-90439, fixed in 1.30.5 / 1.31.6 on September 15) is a separate\nrelease. If you skipped that one, this upgrade covers it too.\n\n## NGINX Plus and other F5 products\n\nF5 lists NGINX Plus R33 through R36 and 37.x as affected, with hotfixes for the 37.0 and 37.1 lines. The\nhotfix numbers in the CVE records don't match across all five CVEs, so take your Plus target version from\nthe F5 K-articles rather than from this page.\n\nThe Canadian Cyber Centre summary of F5's October 14 batch also lists NGINX Ingress Controller before 5.7.0,\nNGINX Gateway Fabric before 2.8.0, NGINX Instance Manager before 2.24.0 and F5 WAF / DoS for NGINX. That\nbatch also includes two njs fixes released the same day (njs 1.0.2), so it doesn't say which of these\nproducts is hit by which of the five nginx CVEs. If you run nginx inside Kubernetes through one of these\nproducts, upgrade the product, not just the image tag you think it uses.\n\n## Level\n\nWe grade it **L3**. nginx sits in front of a huge share of the web, and three of the bugs are memory\ncorruption a remote attacker can reach. It isn't higher because every bug needs a non-default or specific\nconfig, the vendor rates them medium, code execution depends on beating ASLR, and there is no public PoC and\nno reported exploitation."
}