**NGINX** has rolled out critical security updates, **versions 1.30.6** and **1.31.7**, on October 14th to mitigate five distinct vulnerabilities. One of these, a heap overflow (**CVE-2026-15176**), has been present in every **NGINX** release since May 2005, making it a particularly concerning discovery for administrators. ## Understanding the Vulnerabilities **F5**, the company behind **NGINX**, has detailed the five flaws, classifying them by severity and potential impact: * **Three Memory Bugs**: These vulnerabilities, including two heap overflows and one use-after-free, could lead to a worker process crash or, in worst-case scenarios, enable arbitrary code execution. Exploitation requires specific **NGINX** configurations. * **TLS Session Forgery**: This flaw could allow an attacker to forge a **TLS** session, potentially bypassing client-certificate checks. While **F5** notes the forgery is non-deterministic and beyond an attacker's full control, it poses a significant risk to systems relying on robust client authentication. * **HTTP/3 Request Injection**: An issue allowing an **HTTP/3** client to inject extra bytes into a request, which **NGINX** then passes to a backend server. This could bypass size limitations and potentially lead to unexpected behavior or further exploitation. As of October 15th, none of these vulnerabilities were listed in **CISA's Known Exploited Vulnerabilities catalog**, and neither **NGINX** nor **F5** has reported active attacks. **NGINX** rates all five as medium severity, while **F5**'s **CVSS v4.0** scores range from 6.9 for the **HTTP/3** flaw to a critical 9.2 for the memory bugs. ## Exposed Configurations and Remediation Each vulnerability is contingent on specific **NGINX** directives being in use: * **CVE-2026-15176**: Heap overflow impacting versions 0.1.29 to 1.31.6. Triggered by `alias` with a `rewrite` that changes the URI, and any read of `$request_filename`. * **Workaround**: Avoid `alias` in such locations or do not use `$request_filename`. * **CVE-2026-93479**: Heap overflow in versions 1.30.0 to 1.30.5 and 1.31.2 to 1.31.6. Occurs with a regex `map` where captures are referenced by `root` or `log_format` before the map's output variable. * **Workaround**: Use named captures and reference them only within the block with the regex match. * **CVE-2026-97205**: Use-after-free impacting versions 0.8.11 to 1.31.6. Enabled when `aio` is active and an **SSI** page uses `include virtual` commands. * **Workaround**: Disable `aio` or avoid serving **SSI** pages. * **CVE-2026-95101**: **HTTP/3** request injection in versions 1.25.0 to 1.31.6. Occurs when **HTTP/3** is enabled with `proxy_request_buffering on` (which is the default). * **Workaround**: Set `proxy_request_buffering off`. * **CVE-2026-97629**: **TLS** session forgery in versions 1.23.2 to 1.31.6. Triggered by `ssl_session_cache shared:...` without `ssl_session_ticket_key`, which enables automatic key rotation. * **Workaround**: Remove the shared cache directive or load keys from a file. Servers with `ssl_session_tickets off` are not affected. ## A Lingering Flaw from July The `map` flaw, **CVE-2026-93479**, is particularly notable as it stems from string-handling code that **NGINX** previously patched in July for **CVE-2026-42533**. This earlier patch, intended to prevent a heap overflow, inadvertently created new conditions for a similar overflow due to how buffer overruns and string sizing were handled. **F5**'s July workaround for **CVE-2026-42533** was already met with skepticism by researchers, highlighting the complexity of securing deeply embedded code. ## Actionable Advice for Administrators **Ghost Protocol** strongly recommends the following: 1. **Upgrade Immediately**: Update your **NGINX** installations to **1.30.6** (stable branch) or **1.31.7** (mainline). These are the only branches for which **NGINX** publishes fixes directly. Users of older branches or distribution packages should verify if their providers have backported the patches. 2. **Review Configurations**: Use `nginx -T` to print your running configuration and identify if any of the exposed directives (e.g., `alias` with `rewrite`, regex `map` used by `root` or `log_format`, `aio` with `ssi`, shared `ssl_session_cache`, or **HTTP/3** with default `proxy_request_buffering`) are in use. 3. **Implement Workarounds**: If an immediate upgrade is not feasible, apply the specific workarounds provided by **F5** for each vulnerability. While these mitigate the risk, they are not a substitute for upgrading. 4. **F5 Product Users**: Customers using **NGINX Plus**, **F5 Ingress Controller**, **Gateway Fabric**, **Instance Manager**, and **WAF** products should consult **F5**'s advisories for affected builds and available fixes, as some products may not yet have a patched build as of October 15th. Staying proactive in patching and configuration review is paramount to maintaining the security posture of your **NGINX** deployments.