NGINX Patches Five Vulnerabilities Including RCE and TLS Session Flaws
Critical updates address memory corruption and certificate bypass risks across stable and mainline branches.
1Five Critical Security Fixes
NGINX released versions 1.30.6 and 1.31.7 on October 14 to address five distinct vulnerabilities. These flaws include three memory-related bugs capable of crashing worker processes or enabling remote code execution. Additionally, the update resolves a TLS session forgery issue and an HTTP/3 request handling flaw that impacts backend data integrity.
2TLS Session Ticket Vulnerability
A flaw in automatic session ticket key rotation allows potential TLS session forgery. Since version 1.23.2, NGINX generates and rotates keys internally when using a shared session cache. Because the rotation logic failed to initialize all key slots, attackers could theoretically bypass client-certificate checks using uninitialized memory material from previous sessions.
3Memory Corruption in Regex Maps
The map-related vulnerability, CVE-2026-93479, stems from string-handling errors in regex map captures. Despite previous patches in July, data could still spill into reserved memory areas. The current fix enforces strict limits on the document-root path and access-log path to prevent buffer overflows that could lead to unauthorized code execution.
4Asynchronous Operation Counter Flaw
The AIO flaw involves an 8-bit counter that tracks pending asynchronous operations on a request. Because the system lacks overflow checks, 256 concurrent operations cause the counter to wrap to zero. This allows the request to be freed while operations still reference its memory, creating a significant risk for server stability.
5HTTP/3 Request Body Leak
An HTTP/3 parser issue occurs when an unknown frame is split across multiple reads. The parser incorrectly treats the remaining length as part of the request body, bypassing standard client_max_body_size checks. This allows extra bytes to be passed directly to the backend, potentially leading to unexpected data processing or injection.
6Configuration-Specific Exploit Requirements
Exploiting these vulnerabilities requires specific server configurations, such as using regex maps, AIO with SSI, or shared TLS session caches. NGINX documentation often recommends these settings, making many standard deployments potentially vulnerable. Administrators should run nginx -T to identify if their current configuration includes these specific directives that trigger the flaws.
7Upgrade Path and Compatibility
Users must upgrade to version 1.30.6 for the stable branch or 1.31.7 for the mainline branch. Older versions, including 1.28, remain vulnerable unless patches are backported by distribution maintainers. NGINX Plus and F5 product users should consult specific F5 advisories, as some enterprise builds may not have immediate fixes available.
8Security Landscape and Precedence
This release marks the eighth security update for NGINX in 2026. Previous vulnerabilities, such as the May rewrite-module overflow, were exploited within days of disclosure. Given the history of rapid exploitation, immediate patching is essential to mitigate risks from memory corruption and session forgery attempts targeting production server environments.