On October 14, nginx released stable version 1.30.6 and mainline version 1.31.7, with fixes for five vulnerabilities. Each one depends on how nginx is configured, from the alias directive combined with rewrite to HTTP/3 and asynchronous file I/O. The update is the eighth round of nginx security fixes this year.

The security advisories page on nginx.org now lists 26 nginx vulnerabilities from 2026, against two from 2025 and seven from 2024.

Key facts

  • Ratings: nginx.org rates all five as medium on its own scale. The CVE records filed by F5 give three of them a CVSS 3.1 score of 8.1, with high attack complexity.
  • Worst case: for those three, memory corruption can crash a worker process, and code execution is possible where ASLR is disabled or can be bypassed.
  • Old builds: two of the flaws affect code dating back to nginx 0.1.29 and 0.8.11, so running an older upstream release does not by itself avoid them.
  • Packages: on October 15, Debian’s tracker marked the nginx source package as fixed only in its unstable branch. cPanel committed its ea-nginx update to 1.31.7 the same day.

Five Flaws, Each Tied to a Configuration

VulnerabilityConfiguration involvedVulnerable versionsCVSS 3.1
CVE-2026-15176, buffer overflowalias with a URI changed by rewrite, and $request_filename used in set, return or an access log format0.1.29 to 1.31.68.1
CVE-2026-93479, buffer overflowa map’s regex captures used before the map’s output variable in root or a log format, or certain string expressions with non-cacheable variables1.30.0 to 1.30.5, 1.31.2 to 1.31.68.1
CVE-2026-95101, request body injectionHTTP/3 with proxy_request_buffering on, the default setting1.25.0 to 1.31.65.3
CVE-2026-97629, session forgeryssl_session_cache shared with no ssl_session_ticket_key set, in which case nginx has rotated ticket keys automatically since 1.23.21.23.2 to 1.31.66.5
CVE-2026-97205, use-after-freeasynchronous file I/O (AIO) and a Server Side Includes (SSI) page with “include virtual” commands, in certain configurations0.8.11 to 1.31.68.1

On its own scale, nginx.org rates all five as medium. The CVE records, filed by F5, score three of them at 8.1 under CVSS 3.1 and 9.2 under CVSS 4.0, with high attack complexity in both. For those three, the records describe memory corruption in a worker process that can crash it, and code execution on systems where address space layout randomization (ASLR) is disabled or can be bypassed.

In the HTTP/3 flaw, part of an unknown frame might be treated as the request body. According to the changelog, this could allow bypassing the client_max_body_size limit or injecting data into the proxied request. For the session forgery flaw, the CVE record states that an attacker could use it to bypass client certificate verification, and describes the forgery as non-deterministic and beyond the attacker’s control.

Two of the flaws affect code dating back to nginx 0.1.29 and 0.8.11, so running an older upstream release does not by itself avoid them. CVE-2026-93479 is the opposite case. It affects only recent builds, stable 1.30.0 to 1.30.5 and mainline 1.31.2 to 1.31.6.

Ask nginx Which Config It Is Running. Not Every Build Will Answer.

Packages, cPanel and Two Changes in Mainline 1.31.7

The new versions are available from nginx as source code and as binary packages for major Linux distributions. Servers running a distribution’s own nginx package depend on fixes from that distribution instead. On October 15, Debian’s security tracker listed the nginx source package as fixed for all five flaws only in its unstable branch, in version 1.30.4-8.

cPanel builds its ea-nginx package from the mainline branch. The update from 1.31.6 to 1.31.7 was committed to cPanel’s public ea-nginx repository on October 15. The package’s build configuration does not include nginx’s HTTP/3 module, which nginx leaves out unless it is explicitly enabled, so the standard ea-nginx package is not exposed to CVE-2026-95101.

Mainline 1.31.7 also brings two changes that can break a working setup, both listed in the release post’s upgrade notes. The nginx -t configuration test now reports an error for a buffer-size directive set to zero, covering client body and header buffers, proxy buffers and several others. When nginx verifies an upstream certificate by IP address, it now matches the address only against IP-address entries in the certificate’s subject alternative names, not against DNS names or the common name. The release also lets the built-in GeoIP modules read GeoIP2 and GeoLite2 databases in MaxMind’s MMDB format, and switches the HTTP/2 module to the RFC 9218 prioritization scheme.

Eight Rounds of Fixes Since February

The 26 vulnerabilities with 2026 identifiers were fixed in releases on February 4, March 24, May 13, May 22, June 17, July 15, September 15 and October 14. The count covers nginx itself and leaves out njs, its JavaScript module, whose 1.0.2 release on October 14 fixed two vulnerabilities of its own.

Each round shipped both a stable and a mainline release, and the gaps between rounds ranged from nine days to two months. By nginx’s own ratings, 21 of the 26 are medium, three are low and two are major.

For the five flaws fixed on October 14, whether a given server is exposed depends on the nginx build actually installed, on whether its vendor has shipped the fixes, and on whether its configuration uses the features listed in the table.