CVE-2026-97629

NGINX Open Source and NGINX Plus can mishandle SSL session tickets when ssl_session_cache is set to a shared cache and no ssl_session_ticket_key file is configured to rotate ticket keys. A remote unauthenticated attacker can then forge client SSL sessions in a non-deterministic way that the attacker does not fully control, which can skip verification of client certificates. Successful abuse can expose resources or functions, and possibly sensitive data, to unintended clients; this is a data-plane issue only, with no control-plane exposure. It affects NGINX deployments using that TLS session configuration, especially those that rely on mutual TLS. It is not listed in CISA KEV, and no public proof-of-concept is known.

What to do: Apply the NGINX Open Source and NGINX Plus updates from F5 when they are available for your supported release; end-of-support versions were not evaluated. Until patched, set an explicit ssl_session_ticket_key and rotate it on a schedule, or disable SSL session tickets, on any server that uses a shared ssl_session_cache together with client-certificate authentication. Review mTLS-protected resources for unexpected client access.