NGINX patches five flaws including TLS bypass and HTTP/3 injection

NGINX released versions 1.30.6 and 1.31.7 on October 14 to address five security vulnerabilities affecting its web server software. The update, issued by F5, the company behind NGINX, includes fixes for memory corruption bugs, a TLS session forgery issue, and an HTTP/3 data injection flaw. While no active exploitation has been reported, the patches are critical for administrators managing self-hosted infrastructure.

What happened

The release addresses three memory safety bugs that could crash worker processes or potentially allow remote code execution. These issues depend on specific configuration directives being present, such as using alias with rewrite rules, regex maps, or asynchronous I/O with Server Side Includes. F5 rated these memory bugs as critical with a CVSS v4.0 score of 9.2, noting that they require precise conditions to exploit but pose significant risk if triggered.

A fourth vulnerability involves the automatic rotation of TLS session ticket keys. In configurations using a shared session cache without explicit key files, NGINX failed to properly initialize all key slots during rotation. This error could allow an attacker to forge a TLS session, potentially bypassing client-certificate verification. F5 described this forgery as non-deterministic and beyond the attacker's direct control, but it remains a serious authentication bypass risk. The fifth flaw affects HTTP/3 implementations, allowing extra bytes to be injected into proxied requests, which could exceed body size limits or corrupt backend data.

Key details

• CVE-2026-15176 is a heap overflow triggered by alias and rewrite directives, affecting versions from 0.1.29 to 1.31.6.
• CVE-2026-93479 is a heap overflow in regex map handling, present in versions 1.30.0 to 1.30.5 and 1.31.2 to 1.31.6.
• CVE-2026-97205 is a use-after-free bug involving asynchronous I/O and SSI pages, affecting versions from 0.8.11 to 1.31.6.
• CVE-2026-95101 allows HTTP/3 clients to inject extra bytes into proxied requests, affecting versions from 1.25.0 to 1.31.6.
• CVE-2026-97629 enables forged TLS sessions that may bypass client-certificate checks, affecting versions from 1.23.2 to 1.31.6.
• None of the five vulnerabilities were listed in CISA's Known Exploited Vulnerabilities catalog as of October 15.

Background

NGINX is a high-performance web server and reverse proxy widely used for self-hosted applications and enterprise infrastructure. It handles TLS termination, load balancing, and static file serving. Many administrators rely on default or recommended configurations, such as shared SSL session caches, to improve performance by allowing clients to resume sessions without full handshakes. However, these optimizations can introduce complex state management issues, as seen in the recent TLS key rotation bug.

HTTP/3 is the latest version of the HTTP protocol, built on QUIC instead of TCP. It offers faster connection establishment and improved performance over lossy networks. Because HTTP/3 is relatively new in widespread deployment, its implementation in NGINX is still maturing. The recent flaw highlights how parser logic errors in new protocols can lead to unexpected data handling behaviors, such as passing unintended bytes to backend services.

Why it matters

For teams running their own software, these vulnerabilities highlight the risks of relying on default configurations. The TLS bypass flaw, for instance, exists in the exact shared session cache setup recommended in NGINX documentation. Administrators who copied these examples without understanding the underlying key rotation mechanism may have inadvertently exposed their systems to authentication bypasses. This underscores the need for regular configuration audits, not just software updates.

The memory corruption bugs also pose a stability risk. A crashed worker process can lead to service interruptions, while remote code execution could compromise the entire host. Since NGINX often sits at the edge of the network, exposing it to untrusted traffic, any vulnerability that allows code execution is particularly dangerous. Teams must ensure they are running supported branches, as older versions like 1.28 do not receive these fixes unless backported by their distribution.

What you can do

• Upgrade to NGINX 1.30.6 on the stable branch or 1.31.7 on the mainline branch immediately.
• If you cannot upgrade, disable the specific features triggering each flaw, such as turning off aio or removing shared SSL session caches.
• Run nginx -T to inspect your running configuration for risky directives like alias with rewrite or shared ssl_session_cache.
• Check if your Linux distribution has backported the patches if you rely on package manager updates rather than upstream binaries.
• Review HTTP/3 settings and consider disabling proxy_request_buffering if you cannot upgrade to mitigate the injection flaw.
• Monitor F5 advisories for NGINX Plus and related products, as some may not have fixed builds available yet.