NGINX fixes five flaws, including a TLS client-cert bypass
NGINX 1.30.6 and 1.31.7 fix five CVEs: three heap bugs that can crash workers, an HTTP/3 request-smuggling bug, and a TLS session-ticket forgery that can skip client-cert checks.
Stories tagged: #nginx
NGINX 1.31.2 / 1.30.3 patches HTTP/3 UAF (CVE-2026-42530) and two more
F5 shipped NGINX 1.31.2 and 1.30.3 on June 17 fixing a use-after-free in the HTTP/3 module, a heap overflow in proxy_v2/grpc, and a buffer overread in charset.
HTTP/2 Bomb (CVE-2026-49975) drops nginx, Apache, IIS, Envoy
Calif researchers crash 32 GB of Envoy memory in seconds with one connection. nginx 1.29.8 and Apache mod_http2 2.0.41 are patched; IIS, Envoy and Cloudflare Pingora are not.