NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks
NGINX 1.30.6 and 1.31.7 fix five flaws, including possible worker RCE and a TLS client-cert bypass.
NGINX released 1.30.6 and 1.31.7 on October 14, fixing five vulnerabilities, one present since May 2005. Three memory bugs, CVE-2026-15176, CVE-2026-93479, and CVE-2026-97205, can crash a worker or possibly execute code, each only with a specific configuration; F5 scores them 9.2 on CVSS v4.0 while NGINX rates all five medium. CVE-2026-97629 can non-deterministically forge a TLS session and bypass client-certificate checks when a shared session cache auto-rotates ticket keys, and CVE-2026-95101 lets an HTTP/3 client inject extra bytes into a proxied request. None is in CISA's KEV catalog, and neither NGINX nor F5 reports attacks. The map bug follows July's CVE-2026-42533 fix; a similar session-reuse issue was CVE-2025-23419.
- Fixes are in NGINX 1.30.6 and 1.31.7, released October 14.
- Three memory bugs can crash a worker or possibly run code if specifically configured.
- F5 scores those three 9.2 on CVSS v4.0; NGINX rates all five medium.
- Shared session-cache ticket rotation can forge a TLS session and skip client-cert checks.
- None of the five is in CISA KEV, and F5 reports no attacks.
- CVEs
- CVE-2026-15176CVE-2026-93479CVE-2026-97205CVE-2026-95101CVE-2026-97629CVE-2025-23419CVE-2026-42533
- Products
- NGINX
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-23419 | When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate… | 5.3 | 3% | ||
CVE-2026-15176+3 related CVEs | NGINX heap overflow via alias and $request_filename | 9.2 group max | — | ||
| CVE-2026-42533 | A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture… | 9.2 | <1% | PoC ×2 | |
| CVE-2026-95101 | HTTP/3 proxied-request injection in NGINX Plus and Open Source | 6.9 | — |
From the original article
5 min read at thehackernews.com
NGINX released versions 1. 30. 6 and 1.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.