NGINX has released version 1.30.6 and 1.31.7 on 14 October 2026 to fix five vulnerabilities, one of which has existed in every release since May 2005.
The advisory from F5 (the maker of the NGINX ecosystem) describes three memory-related flaws that could crash a worker process or allow code execution under certain configurations, a fourth flaw that could allow an attacker to forge TLS sessions and bypass client-certificate checks (non-deterministic and not fully under attacker control, according to F5), and a fifth flaw where an HTTP/3 client could slip extra bytes into a request that is passed to a backend.
None of the five appeared in the CISA Known Exploited Vulnerabilities catalog as of 15 October 2026, and there have been no confirmed attacks publicly reported by NGINX or F5. The CVSS v4.0 scores provided by F5 rate the three memory bugs as 9.2 (Critical), the TLS flaw as 8.3, and the HTTP/3 flaw as 6.9.
The exploits require a specific configuration exposed by the server: alias with a rewrite, a regex map, AIO with SSI, a shared TLS session cache, or HTTP/3. Affected version ranges include 0.1.29 to 1.31.6 (for the alias/heap-overflow and related issues), 1.30.0 to 1.30.5 and 1.31.2 to 1.31.6 (regex map flaw), 0.8.11 to 1.31.6 (AIO/SSI), 1.25.0 to 1.31.6 (HTTP/3 issue), and 1.23.2 to 1.31.6 (TLS session tickets issue). Upgrading to 1.30.6 (stable) or 1.31.7 (mainline) is recommended.
Where upgrades are not possible, F5 provides workarounds for each flaw; administrators can verify exposed paths with nginx -T and search for the relevant directives (alias with rewrite, regex map, aio with SSI, shared ssl_session_cache, and ssl_session_cache shared without ssl_session_ticket_key). The article also notes a prior July 2026 fix that partially addressed one related overflow, tying the new flaw to an earlier change.