Skip to content
Hacker Posts

NGINX fixes five flaws, including a TLS client-cert bypass

NGINX 1.30.6 and 1.31.7 fix five CVEs: three heap bugs that can crash workers, an HTTP/3 request-smuggling bug, and a TLS session-ticket forgery that can skip client-cert checks.

Published 2 min read
cvenginxtlsadvisory

NGINX shipped 1.30.6 (stable) and 1.31.7 (mainline) on October 14, fixing five vulnerabilities. NGINX rates all five medium; F5, which maintains the commercial builds, scores the three memory bugs 9.2. The primary source is the NGINX security advisories page, with per-CVE detail in F5's knowledge base. Anything on mainline ≤1.31.6 or stable ≤1.30.5 is affected by all five.

Affected configurations

Each bug needs a specific config, so triage by what you actually run:

  • CVE-2026-15176 — heap overflow when alias with a URI-changing rewrite meets $request_filename. Present since 0.1.29.
  • CVE-2026-93479 — heap overflow when regex map captures feed root or log_format. Introduced by the July patch (CVE-2026-42533); affects 1.30.0–1.30.5 and 1.31.2–1.31.6.
  • CVE-2026-97205 — use-after-free with aio on SSI pages using include virtual.
  • CVE-2026-95101 — HTTP/3 with proxy_request_buffering on (the default) injects extra bytes into the proxied request body, which can exceed client_max_body_size.
  • CVE-2026-97629 — TLS session-ticket forgery (F5 score 8.3). Automatic ticket-key rotation left a third key slot uninitialized; a ticket naming that slot can be decrypted with uninitialized memory, forging a session that may bypass client-certificate verification. Affects 1.23.2–1.31.6.

Exploitation status

None are in CISA's KEV catalog as of October 15, and neither NGINX nor F5 reports attacks. F5 describes the TLS forgery as "non-deterministic" and "beyond the attacker's control," which lowers but does not eliminate the risk. The three heap bugs are described as crashes with code execution only "possible."

Action checklist

  1. Upgrade to 1.31.7 (mainline) or 1.30.6 (stable). Older branches like 1.28 are not patched upstream; distro packages are fixed only if the maintainer backported.
  2. If you can't patch the TLS bug now, remove the shared ssl_session_cache directive or load keys explicitly with ssl_session_ticket_key. ssl_session_tickets off is unaffected.
  3. For the HTTP/3 smuggling bug, set proxy_request_buffering off as a stopgap.
  4. Check your running version with nginx -v and confirm the config triggers above against your deployed sites.

Context

This is the second NGINX memory-safety batch in three months — the July release fixed CVE-2026-42533 (F5 9.2), and VulnCheck recorded exploitation of the May rewrite-module overflow (CVE-2026-42945) within days of disclosure. The map-capture bug here was introduced by that July fix, a reminder that rushed patches to the request-processing path carry their own regression risk. The TLS forgery echoes CVE-2025-23419, a session-reuse flaw fixed in February 2025.

Related stories