NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks

NGINX Patches Five Flaws, Three With Possible Remote Code Execution

F5, the company behind NGINX, released versions 1.30.6 (stable) and 1.31.7 (mainline) on October 14, 2026, closing out five vulnerabilities across both the open-source project and NGINX Plus. Three of the five are memory-safety bugs — two heap buffer overflows and a use-after-free — that F5 says could crash a worker process in the ordinary case and, under harder-to-achieve conditions such as a disabled or bypassed ASLR, possibly allow remote code execution. Each of the three carries a CVSS v3.1 score of 8.1 (High) and a CVSS v4.0 score of 9.2 (Critical), and each requires a specific, non-default configuration directive to be reachable.

A fourth flaw, CVE-2026-97629, is a TLS session-ticket forgery bug that can, in a non-deterministic way outside an attacker's control, let a forged session be decrypted and verified — potentially bypassing client-certificate authentication on deployments that rely on it. The fifth, CVE-2026-95101, is an HTTP/3 request-parsing flaw that can let an attacker inject extra bytes into a proxied request or bypass client_max_body_size. None of the five has been added to CISA's Known Exploited Vulnerabilities catalog as of this writing, and neither NGINX nor F5 has reported active exploitation. Notably, the oldest of the five — CVE-2026-15176 — has been present in every NGINX release since version 0.1.29, shipped in May 2005, making it roughly two decades old before discovery.

Vulnerability Details

Fixed in: nginx 1.30.6 (stable) and 1.31.7 (mainline), released October 14, 2026. NGINX Plus customers receive the equivalent fix in 37.0.5.1 / 37.1.0.1 for the three memory-corruption bugs and the TLS ticket-forgery bug, and in 37.0.7.1 / 37.2.0.1 for the HTTP/3 flaw. Note that nginx.org's own advisory classifies all five issues as "medium" severity under its simplified internal scale, while F5's formal advisories rate the three memory bugs High/Critical under the standard CVSS v3.1/v4.0 scoring used industry-wide — the discrepancy reflects two different rating methodologies for the same underlying bugs, not a disagreement about technical impact.

How the Flaws Work

The Three Memory-Corruption Bugs (Possible RCE)

All three high-severity bugs are unauthenticated, network-reachable issues triggered by crafted HTTP requests against specific, non-default configurations:

• CVE-2026-15176 (heap overflow) fires when a location block combines the alias directive with rewrite, and something — a set/return directive or an access log_format — reads the $request_filename variable in the window after the rewrite changes the URI but before NGINX resolves the next location. If the location's prefix is longer than the rewritten URI, mapping it to a file path overflows a heap buffer.
• CVE-2026-93479 (heap overflow) occurs when a map directive uses regex capture groups, and the root directive or an access log_format references those capture variables before the map's own output variable is referenced — or when a non-cacheable variable is used in a string expression under similar conditions.
• CVE-2026-97205 (use-after-free) triggers when asynchronous file I/O (aio) is enabled and an SSI (Server Side Includes) page uses an include virtual command, corrupting memory in the worker process.

F5 describes the realistic outcome of all three as a worker-process crash and restart (denial of service). The company's advisories add that on systems where Address Space Layout Randomization (ASLR) is disabled or can be bypassed by the attacker, the same memory corruption could theoretically be leveraged for code execution — the basis for the "possible RCE" framing in F5's and NGINX's own advisory language. No public proof-of-concept or in-the-wild exploitation has surfaced for any of the three as of October 15, 2026.

The TLS Session-Ticket Forgery / Client-Cert Bypass — CVE-2026-97629

This bug lives in ngx_http_ssl_module and affects deployments using NGINX's documented session-resumption example, ssl_session_cache shared:SSL:10m, without an explicitly configured ssl_session_ticket_key file to control key rotation. Each worker process keeps three session-ticket key slots, but the automatic rotation logic only updates two of them — leaving the third populated with whatever was previously in that memory region. A client presenting a forged session ticket that happens to reference the stale third slot can have that ticket verified and decrypted using the uninitialized key material, producing a forged session. F5 describes the process as "non-deterministic ... beyond the attacker's control," meaning exploitation isn't reliably repeatable on demand, but when it succeeds it can bypass verification of client TLS certificates — a serious problem for mutual-TLS (mTLS) deployments that depend on client-cert checks as an access-control layer. The issue is classified as CWE-908 (Use of Uninitialized Resource), carries no confidentiality impact on its own, and is a data-plane-only issue with no control-plane exposure.

The HTTP/3 Request Injection — CVE-2026-95101

Found in ngx_http_v3_module, this flaw stems from a single internal parser field doing two unrelated jobs: tracking the remaining byte length of an unrecognized QUIC frame being skipped, and tracking the number of DATA bytes to forward as request body. Under HTTP/3 with proxy_request_buffering on — NGINX's default setting — an unauthenticated attacker can exploit that overlap to have extra bytes injected into a proxied request, or to deliver a request body that exceeds the configured client_max_body_size without being blocked. Because the vulnerable setting is the out-of-the-box default, any HTTP/3-enabled deployment is exposed without any unusual configuration choices. F5 rates it CWE-172 (Encoding Error) and recommends setting proxy_request_buffering off as an interim mitigation for sites that cannot patch immediately.

An Overflow Older Than Most Production Deployments

CVE-2026-15176 is the standout in terms of age: nginx.org lists it as present from version 0.1.29, which shipped in May 2005 — meaning the alias/rewrite heap overflow has shipped in every stable and mainline NGINX release for roughly two decades before this week's fix. CVE-2026-97205, the use-after-free in AIO/SSI handling, dates back nearly as far, to version 0.8.11 in 2009.

Impact Assessment

Recommendations

For NGINX Administrators

• Upgrade to nginx 1.30.6 (stable) or 1.31.7 (mainline) immediately — this is the only complete fix for all five issues.
• NGINX Plus customers should move to 37.0.5.1 / 37.1.0.1 (or later) to cover the three memory bugs and the TLS ticket-forgery bug, and confirm they are also on 37.0.7.1 / 37.2.0.1 (or later) for the HTTP/3 fix.
• If you run NGINX Ingress Controller, NGINX Gateway Fabric, NGINX Instance Manager, F5 WAF for NGINX, or F5 DoS for NGINX, check F5's advisories for the matching patched release of each product — these inherit the core memory-corruption bugs and ship on separate version trains.
• Until you can patch, apply the available interim mitigations where relevant: avoid combining alias with rewrite and $request_filename (CVE-2026-15176); replace unnamed regex captures in map blocks with named captures scoped to the block that produced them (CVE-2026-93479); disable aio or SSI processing where both are enabled together (CVE-2026-97205); set proxy_request_buffering off for HTTP/3 virtual servers (CVE-2026-95101).

For Security Teams

• Audit any configuration that relies on ssl_session_cache shared:... for TLS session resumption and confirm an explicit ssl_session_ticket_key file with managed rotation is configured — this is the only mitigation for CVE-2026-97629 short of patching, and it directly affects the integrity of client-certificate (mTLS) authentication.
• Inventory every NGINX-based edge device and ingress point (API gateways, Kubernetes ingress controllers, reverse proxies, CDN origins) rather than assuming a single patch cycle covers the whole fleet — NGINX commonly runs embedded inside other appliances and platforms.
• Monitor for worker-process crash/restart anomalies in NGINX error logs as a potential indicator of exploitation attempts against the memory-corruption bugs, even pre-patch.
• Track F5's and nginx.org's advisories for updates — none of the five CVEs is in CISA's KEV catalog today, but that status can change quickly once public patches enable reverse engineering.

For Organizations Running mTLS or Client-Certificate Authentication

• Treat CVE-2026-97629 as a priority even though it carries a "Medium" CVSS v3.1 score — a successful client-certificate bypass undermines an authentication control that many organizations treat as a strong, device-bound trust boundary.
• After patching, consider rotating TLS session ticket keys and auditing recent authenticated sessions on affected systems if ssl_session_ticket_key was not explicitly configured prior to the fix.

Key Takeaways

1. NGINX 1.30.6 and 1.31.7, released October 14, 2026, fix five vulnerabilities across NGINX Open Source and NGINX Plus — the eighth NGINX security release of 2026.
2. Three bugs (CVE-2026-15176, CVE-2026-93479, CVE-2026-97205) are unauthenticated memory-corruption flaws rated CVSS v3.1 8.1 (High) / v4.0 9.2 (Critical) by F5, each requiring a specific, non-default configuration to trigger, with crash/DoS as the likely outcome and code execution flagged as a theoretical worst case.
3. CVE-2026-97629 can let a forged TLS session bypass client-certificate verification due to uninitialized key material left behind by incomplete session-ticket key rotation — a serious concern for mTLS deployments.
4. CVE-2026-95101 affects HTTP/3 deployments using the default proxy_request_buffering on setting, allowing data injection into proxied requests or bypass of request body-size limits.
5. CVE-2026-15176 has existed in every NGINX release since version 0.1.29 in May 2005 — nearly 21 years of exposure before discovery and a fix.
6. No active exploitation or CISA KEV listing has been reported as of October 15, 2026, but patches are public, so administrators should upgrade now rather than wait for a KEV listing to force the issue.

Sources

• The Hacker News — NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks
• nginx.org — Security Advisories
• F5 Security Advisory — CVE-2026-97629 (ngx_http_ssl_module)
• F5 Security Advisory — CVE-2026-95101 (ngx_http_v3_module)
• F5 Security Advisory — CVE-2026-15176 (ngx_http_core_module)
• F5 Security Advisory — CVE-2026-97205 (ngx_http_core_module)