nginx 1.30.6/1.31.7 Fix 5 CVEs, Including CVE-2026-15176 (alias+rewrite)

I happened to open the security advisories page on nginx.org and found that stable 1.30.6 and mainline 1.31.7, released on 14 Oct. 2026, fixed 5 vulnerabilities at once, so I went through all of 2026 to see what else might still be outstanding. The page lists 26 advisories for CVEs from 2026, covered by 8 releases from February through October. If you have kept up with the releases, there is no need to worry, but if you have left nginx untouched since the start of the year, you have a lot of fixes pending.

What happened

The five issues fixed in 1.30.6 and 1.31.7, according to nginx CHANGES:

• CVE-2026-15176 A buffer overflow in a worker when alias is used and a URI is changed by rewrite, then mapped to a file path. Affects 0.1.29 through 1.31.6.
• CVE-2026-93479 A buffer overflow when evaluating string expressions containing variables, affecting document root calculations and request logging in both the http and stream modules. Affects 1.31.2 through 1.31.6 and 1.30.0 through 1.30.5.
• CVE-2026-95101 When using HTTP/3, part of an unknown frame may be counted as the request body, allowing the client_max_body_size limit to be bypassed or data to be injected into a proxied request. Affects 1.25.0 through 1.31.6.
• CVE-2026-97629 When TLS session ticket key rotation is used, one key is left uninitialized, which may allow session forgery. Affects 1.23.2 through 1.31.6.
• CVE-2026-97205 A use-after-free when asynchronous file I/O (AIO) is used in certain configurations and an SSI page contains an include virtual directive. Affects 0.8.11 through 1.31.6.

Another issue fixed earlier was CVE-2026-90439 on 15 Sept. 2026 (1.31.6 and 1.30.5), a heap overflow in a worker when using HTTP/3 with OpenSSL 3.5.0 or earlier in certain configurations. It affects 1.29.2 through 1.31.5. Upgrading to 1.30.6 or 1.31.7 includes this fix too.

Severity

The nginx.org page rates all five issues as medium and provides no CVSS scores. I opened the linked F5 advisory pages, but they displayed no content (just a portal shell that failed to load), so I have left out scores I could not verify. None of these issues appears in CISA's KEV catalog in the file released on 3 Nov. 2026, and the nginx page does not state that they have been exploited in the wild.

Medium here does not mean you can leave it alone. A buffer overflow in a worker can at least crash the worker, and nginx's own wording does not rule out other outcomes. I give CVE-2026-95101 and CVE-2026-97629 high priority because their affected version ranges are very broad (starting at 1.25.0 and 1.23.2). If you enable HTTP/3 or terminate TLS at nginx, assume you are affected for now.

Who is affected across 2026

I compiled this table from the advisories page and CHANGES. The dates are the mainline release dates in CHANGES; the stable versions containing the fixes come from the "fixed in" field on the advisories page.

The two issues rated Major on the advisories page are CVE-2026-42533 and CVE-2026-42530. I have already covered the first in An nginx heap overflow going back 15 years. Upgrading to 1.30.6 or 1.31.7 includes every fix in the table. If you are on 1.28.x or 1.29.x, you need to move to 1.30.x or 1.31.x, because for issues from May onward, the advisories page lists fixed versions only in those two branches.

The latest mainline version is 1.31.8 (21 Oct. 2026). It contains no new security entries, but it does include a "Change" making the working_directory path relative to the prefix directory. If you use mainline, read it before upgrading.

nginx.org also announced njs 1.0.2 on the same day (14 Oct.), fixing CVE-2026-101025 (memory exhaustion when parsing malformed XML) and CVE-2026-101019 (inconsistent XML attribute values affecting signed XML validation). If you use njs, check its version separately from nginx.

Check whether your configuration is affected

Start with the version and build options.

nginx -v
nginx -V 2>&1 | grep -iE 'built with openssl'
nginx -V 2>&1 | tr ' ' '\n' | grep -E 'http_v3|http_ssi|file-aio'

Then search for the relevant directives in the configuration nginx actually loads (including all includes).

sudo nginx -T 2>/dev/null | grep -nE '^\s*(alias|rewrite|ssi|aio|http3|ssl_session_ticket)|listen .*quic'

Read the results as follows. If you find alias and rewrite in the same site, treat it as affected by CVE-2026-15176. If you find quic or http3, it is affected by CVE-2026-95101 (and CVE-2026-90439 if it uses OpenSSL 3.5.0 or earlier). If you find ssi on together with aio, treat it as affected by CVE-2026-97205. For CVE-2026-93479, I cannot narrow this down with a filter, because "evaluating variables to calculate the root or log" is already part of typical configurations. Treat all versions from 1.30.0 through 1.30.5 and 1.31.2 through 1.31.6 as affected.

For CVE-2026-97629, I cannot confirm whether configurations that do not explicitly set ssl_session_ticket_key meet the conditions, because CHANGES says only "when using key rotation." I therefore recommend treating every machine that terminates TLS with nginx in the affected version range as affected until it is upgraded.

How to fix it

nginx.org and the advisories page have not published workarounds for this set of issues. The available fix is to upgrade.

1. Check the version and configuration Check whether the version is in an affected range and whether the relevant directives are present.
2. Update the package To stable 1.30.6 or mainline 1.31.7 or later.
3. nginx -t, then restart Not just reload.
4. Check that the master process is running the new binary Before closing the task.

# แพ็กเกจจาก repo ของ nginx.org หรือ distro (Debian / Ubuntu)
sudo apt update
sudo apt install --only-upgrade nginx
sudo nginx -t && sudo systemctl restart nginx

# RHEL / Rocky / AlmaLinux
sudo dnf upgrade nginx
sudo nginx -t && sudo systemctl restart nginx

If you use a distro package, the version number may remain unchanged because of backports. Check the changelog for the CVE IDs.

apt changelog nginx | grep -oE 'CVE-2026-[0-9]+' | sort -u
rpm -q --changelog nginx | grep -oE 'CVE-2026-[0-9]+' | sort -u

Check that the master process is running the new binary. If the binary has been replaced but the old process is still running, you will see (deleted) at the end (the pid file path depends on the installation).

sudo readlink /proc/$(cat /run/nginx.pid)/exe

For machines with nginx installed through DirectAdmin CustomBuild, update the lists and rebuild. For containers, rebuild the image by pulling a fresh base image without using the cache, then redeploy every container.

cd /usr/local/directadmin/custombuild && ./build update && ./build nginx
docker build --pull --no-cache -t myapp:nginx-fixed .

Check whether you have been exploited

nginx and F5 have not published IOCs for these issues, so I can only point to a general sign of buffer overflows and use-after-free: workers crashing repeatedly.

sudo grep -hE 'worker process [0-9]+ exited on signal' /var/log/nginx/error.log* | tail -20

If you see this often, investigate which requests preceded the crashes. If you do not see it, that does not mean you are safe, especially for CVE-2026-97629, which involves session forgery and leaves no crash evidence in the logs.

Personally, for machines that enable HTTP/3 or terminate TLS at nginx, I would upgrade within a few days. There is no need to do it overnight, because these issues are not yet in KEV and I have seen no reports of exploitation in the wild from the primary sources. I would put the rest into the normal maintenance cycle. What I do not recommend is waiting for the distro to catch up. If you do wait, check the changelog periodically, as staffing allows.

P.S. If you are still on 1.28.x or 1.29.x, this is a good time to move to stable 1.30.x, because the later issues have no fixed versions available in the old branches.

Sources: nginx.org Security advisories (https://nginx.org/en/security_advisories.html), nginx.org CHANGES (https://nginx.org/en/CHANGES), nginx.org News (https://nginx.org/), CISA Known Exploited Vulnerabilities Catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog). Information current as of 5 Nov. 2026; KEV checked against the file CISA released on 3 Nov. 2026. I will come back and update this later.