NGINX's October security drop fixes five medium-severity flaws in one go — and the vulnerable range for one of them stretches all the way back to the 0.1.x era. Here's how to tell whether your config is actually exposed, and the exact upgrade path.

What dropped on October 14

NGINX pushed 1.31.7 (mainline) and 1.30.6 (stable) with fixes for five flaws, all rated medium by F5's security advisories:

  • CVE-2026-15176 — buffer overflow when alias meets rewrite in the same location (vulnerable: 0.1.29–1.31.6)
  • CVE-2026-93479 — buffer overflow in script evaluation when regex captures are referenced the wrong way (vulnerable: 1.30.0–1.30.5, 1.31.2–1.31.6)
  • CVE-2026-95101 — request body injection in HTTP/3: a crafted frame can smuggle bytes past client_max_body_size to the backend (vulnerable: 1.25.0–1.31.6)
  • CVE-2026-97629 — TLS session ticket forgery that can bypass client-certificate checks (vulnerable: 1.23.2–1.31.6)
  • CVE-2026-97205 — use-after-free when async file I/O meets Server Side Includes (vulnerable: 0.8.11–1.31.6)

This is NGINX's eighth security release of 2026. F5 reports no active exploitation of these five — yet. But the pattern is familiar: in May, a similar rewrite-module overflow (CVE-2026-42945) was being exploited within days of disclosure. "Medium" is not "ignore it."

The detail everyone misses: your version isn't the whole story

Four of the five flaws only trigger under specific configuration patterns. A vulnerable version running a config that never touches those paths isn't exploitable through these CVEs — so the operator's first move isn't the version string, it's the running config. Dump it all, including every include file:

nginx -T

Then grep the dump for the trigger patterns:

  • alias sitting in a location next to a rewrite — CVE-2026-15176
  • unnamed regex captures referenced by root or log_format outside the matching block — CVE-2026-93479
  • aio enabled together with ssi, on pages using include virtual — CVE-2026-97205
  • listen lines with quic — CVE-2026-95101
  • ssl_session_cache shared without rotating ssl_session_ticket_key — CVE-2026-97629

Presence of a vulnerable version alone doesn't prove exposure. Presence of the version plus the pattern does.

Archaeology: bugs that outlived their distros

Two of the five flaws are ancient by software standards. CVE-2026-15176 is listed as vulnerable from 0.1.29 — the mid-2000s, before most of today's servers were even provisioned. CVE-2026-97205 reaches back to 0.8.11, the late 2000s. Those code paths survived two decades of releases, refactors, and renames without anyone tripping over them.

The uncomfortable lesson: "battle-tested" and "bug-free" aren't synonyms. The quiet, never-touched code path is exactly where the next memory-safety bug lives — and in a reverse proxy that sits in front of everything, one corrupted worker process is one request away from becoming a crash, or worse.

The patch playbook

  1. Check what you're actually running. nginx -v gives the build version — but your distro package may already have backports. Cross-check the distro's security tracker (Debian, Ubuntu, RHEL all publish CVE-to-package mappings) before assuming you're exposed.
  2. Pick your branch deliberately. Stable users want 1.30.6 — it contains only fixes, no new behavior. Mainline users go to 1.31.7. Note that NGINX only publishes fixes for these two branches: older ones like 1.28 stay inside the affected ranges unless your distribution backports the patches itself.
  3. Reload, don't restart. After upgrading or changing config, validate with nginx -t, then nginx -s reload. A graceful reload keeps existing connections alive; a full restart drops them — exactly the kind of self-inflicted downtime that makes patching feel scarier than the bug.
  4. If you can't patch today, F5's advisories carry per-flaw workarounds: disable aio or ssi (CVE-2026-97205), avoid alias inside location blocks in favor of root plus rewrite (CVE-2026-15176), switch unnamed regex captures to named ones used only inside the matching block (CVE-2026-93479). These cover the known trigger paths — the upgrade remains the real fix.
  5. Watch the error log. Several of these flaws manifest as worker process crashes. A sudden run of worker process exited lines in your error log is the fingerprint of someone probing — treat it as a signal to patch faster, not just noise.

Don't forget njs

The same day, NGINX also shipped njs 1.0.2, fixing two medium-severity XML-handling flaws (CVE-2026-101025, CVE-2026-101019) in its embedded JavaScript module. If your config loads njs — and plenty of API-gateway setups do — that's a second package to bump in the same maintenance window.

Sources