nginx 1.30.6 and 1.31.7 fix five worker-process bugs: three heap overflows/UAF, HTTP/3 body injection, forged TLS sessions
nginx.org rates all five Medium, but F5's CVE records score three memory-corruption bugs at CVSS 8.1. Each needs a specific config: alias plus rewrite, regex map captures, AIO with SSI, HTTP/3, or rotated TLS session tickets. No exploitation reported.
If your config uses one of a handful of features in a particular way, a crafted request can make an nginx worker write past a buffer or use freed memory and crash, or let an attacker smuggle extra bytes into an HTTP/3 request body or resume a TLS session they never had.
On October 14, 2026, nginx shipped 1.30.6 (stable) and 1.31.7 (mainline) with five security fixes. F5 published matching advisories and CVE records the same day. The bugs live in the worker process, so the control plane is not exposed. None of them hits a default build with a default config: each needs a particular feature switched on, or switched on in a particular way.
nginx.org rates all five “medium”. F5’s CVE records give three of them CVSS 3.1 8.1 (CVSS 4.0 9.2): the alias/rewrite overflow, the variable-evaluation overflow and the AIO/SSI use-after-free. The high scores come from the possibility of code execution. F5 says that only works where ASLR is disabled or can be bypassed; otherwise the result is a crashed and restarted worker. The attack complexity is rated high because the attacker can’t choose the server’s config. Some news summaries call these “critical” because of the 9.2 CVSS 4.0 score; the vendor’s own label is medium.
alias in a location, plus rewrite, plus $request_filename used in set, return
or a log format. This one goes back to 0.1.29, so it reaches very old installs too.map with regex captures where the capture variables are used in root or a log
format. Introduced in 1.30.0 / 1.31.2. F5 suggests named captures as a workaround.listen ... quic socket, but it ships in many packaged builds.ssl_session_cache shared:... without an ssl_session_ticket_key file, which is a common
setup (tickets are on by default). The forgery doesn’t always work, but it can get past client certificate
checks, which matters if you use mTLS for auth.aio (off by default) together with SSI pages that use include virtual. nginx.org
lists versions back to 0.8.11 as vulnerable; F5’s CVE record lists only 1.30.0 and later. We go with
nginx.org for the open-source ranges.The earlier HTTP/3 heap overflow (CVE-2026-90439, fixed in 1.30.5 / 1.31.6 on September 15) is a separate release. If you skipped that one, this upgrade covers it too.
F5 lists NGINX Plus R33 through R36 and 37.x as affected, with hotfixes for the 37.0 and 37.1 lines. The hotfix numbers in the CVE records don’t match across all five CVEs, so take your Plus target version from the F5 K-articles rather than from this page.
The Canadian Cyber Centre summary of F5’s October 14 batch also lists NGINX Ingress Controller before 5.7.0, NGINX Gateway Fabric before 2.8.0, NGINX Instance Manager before 2.24.0 and F5 WAF / DoS for NGINX. That batch also includes two njs fixes released the same day (njs 1.0.2), so it doesn’t say which of these products is hit by which of the five nginx CVEs. If you run nginx inside Kubernetes through one of these products, upgrade the product, not just the image tag you think it uses.
We grade it L3. nginx sits in front of a huge share of the web, and three of the bugs are memory corruption a remote attacker can reach. It isn’t higher because every bug needs a non-default or specific config, the vendor rates them medium, code execution depends on beating ASLR, and there is no public PoC and no reported exploitation.
CVE-2026-15176CVSS 8.1Heap overflow in a worker when a location uses alias, the URI was changed by rewrite, and $request_filename is used (in set, return or an access log format). Affects 0.1.29 to 1.31.6.
In plain poop: a very old pipe that only bursts if you plumbed it one specific way.
CVE-2026-93479CVSS 8.1Heap overflow when string expressions with variables are evaluated, e.g. a regex map whose capture variables are used in root or a log format before the map's own output. Affects 1.30.0 to 1.30.5 and 1.31.2 to 1.31.6.
CVE-2026-95101CVSS 5.3Part of an unknown HTTP/3 frame can be treated as request body, bypassing client_max_body_size or injecting data into the proxied request. Affects 1.25.0 to 1.31.6.
In plain poop: someone slips an extra note into the envelope after you sealed it.
CVE-2026-97629CVSS 6.5With a shared ssl_session_cache and no ssl_session_ticket_key file, one auto-rotated ticket key is left uninitialised, so a session can sometimes be forged, which can skip client certificate checks. Affects 1.23.2 to 1.31.6.
CVE-2026-97205CVSS 8.1With aio enabled in some configurations, an SSI page using "include virtual" can trigger a use-after-free in a worker.
Run nginx -v on each box, then type the version or pick the closest match.
| Branch | Safe from | Status |
|---|---|---|
| nginx mainline 1.31.x | 1.31.7 | Mainline |
| nginx stable 1.30.x | 1.30.6 | Stable |
| nginx 1.28 and older | none | Unsupported, upgrade to 1.30.6+ |
# CVE-2026-97629: pin ticket keys (or turn tickets off) ssl_session_ticket_key /etc/nginx/ticket.key; # ssl_session_tickets off; # CVE-2026-97205: no AIO where SSI pages are served aio off; # CVE-2026-95101: on HTTP/3 servers proxy_request_buffering off;
Each line covers one CVE only, and the two buffer overflows have no switch: you would have to stop using alias/$request_filename or unnamed regex captures. Upgrading is the real fix.
Sep 15, 2026
nginx 1.30.5 / 1.31.6 fix an HTTP/3 heap overflow
CVE-2026-90439, a separate earlier release; not part of this batch.
Oct 14, 2026
nginx 1.30.6 (stable) and 1.31.7 (mainline) released with five security fixes
F5 publishes K-articles and CVE records the same day, plus NGINX Plus hotfixes.
Oct 15, 2026
Canadian Cyber Centre publishes advisory AV26-1049
Oct 21, 2026
nginx 1.31.8 mainline released
Newer than the fix, so it also contains it.
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.