NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks

NGINX released versions 1.30.6 and 1.31.7 on October 14 to fix five vulnerabilities, one of them present in every release since May 2005.

There are three memory bugs that F5, the company behind NGINX, says could crash a worker process or possibly let an attacker run code, and each requires a specific configuration to exploit.

A fourth lets an attacker forge a TLS session that could get past client-certificate checks, though F5 calls the forgery non-deterministic and beyond the attacker’s control. The fifth lets an HTTP/3 client slip extra bytes into a request that NGINX passes on to a backend.

None of the five was in CISA’s Known Exploited Vulnerabilities catalog as of October 15, and neither NGINX nor F5 reports attacks. NGINX rates all five medium. F5 scores the three memory bugs 9.2, Critical, on CVSS v4.0, the TLS flaw 8.3, and the HTTP/3 flaw 6.9.

Which Configurations Are Exposed

Every one of the five needs a directive you added: an alias with a rewrite, a regex map, AIO with SSI, a shared TLS session cache, or HTTP/3. NGINX’s own documentation recommends the shared session cache and request buffering; the other condition for the HTTP/3 flaw is on by default.

The TLS flaw sits in the automatic rotation of session ticket keys. Session tickets let a client resume a TLS session without a full handshake, and since version 1.23.2, from October 2022, a shared session cache makes NGINX generate and rotate the ticket keys itself unless you load keys from a file.

Each worker process keeps a copy of three key slots. Rotation copied only two, so the third slot held whatever was in memory before, and a ticket naming that slot could be verified and decrypted with that uninitialized key material, “allowing a forged session,” the fix commit says.

F5 says the forgery works “in a non-deterministic manner that is beyond the attacker’s control,” and that an attacker could use it to bypass verification of client certificates. The exposed setting, ssl_session_cache shared:SSL:10m, is the one NGINX’s documentation uses in its example configuration. NGINX fixed a session-reuse flaw with the same consequence, CVE-2025-23419, in February 2025.

The conditions and workarounds below are NGINX’s and F5’s. The version ranges are from NGINX’s advisories page.

One Flaw Traces to July’s Fix

The map flaw, CVE-2026-93479, is in the string-handling code that NGINX patched on July 15 for CVE-2026-42533, a heap overflow F5 scored 9.2 that is reached through a regex map’s captures.

The new overflow became possible after a change in that July release, according to the fix commit. A July patch added protection against overrunning a buffer, but data could still spill into a reserved area, and a second July patch then sized the final string from that spilled length, so the string could outgrow its buffer.

The commit puts limits on it. The overflow is at most the size of the reserved area on the document-root path, and a single null byte on the access-log path.

F5’s advisory and NGINX’s advisories page list 1.30.0 and 1.31.2 as the earliest affected versions, which come before the July change. A server patched in July is inside the affected range either way.

F5’s July workaround had already been questioned. Researcher Stan Shaw told The Hacker News in July that switching to named captures left a narrower path open, and that upgrading was “the only complete fix.”

The fix commits for the alias, AIO and HTTP/3 flaws describe the other three bugs. The alias flaw opens in the moment after a rewrite changes a request’s URI and before NGINX picks the next location. If anything reads $request_filename in that window, and the location’s prefix is longer than the rewritten URI, mapping the URI to a file path overflows a buffer.

The AIO flaw is a counter. Each pending asynchronous operation on a request adds one to an 8-bit field with no check, so 256 pending operations wrap it to zero and the request can be freed while those operations still point at its memory. NGINX names SSI pages with include virtual commands, which can run their included requests in parallel, as the trigger.

The HTTP/3 flaw came from one parser field doing two jobs: holding the remaining length of an unknown frame being skipped, and the number of DATA bytes to pass on as request body. When an unknown frame was split across two reads, the leftover count was treated as body and sent to the backend, outside the client_max_body_size check.

What to Do

Upgrade to 1.30.6 on the stable branch or 1.31.7 on mainline. The stable release contains only fixes. NGINX publishes fixes for those two branches only, so older branches such as 1.28 stay inside the affected ranges, and a distribution package is fixed only if your distribution has backported the patches.

NGINX Plus customers, and users of F5’s Ingress Controller, Gateway Fabric, Instance Manager and WAF products, should check F5’s advisories, which list affected builds and, for several products, no fixed build as of October 15.

If you cannot upgrade yet, the table above has F5’s workaround for each flaw. To see which paths your server has enabled, print the running configuration with nginx -T and search it for alias beside a rewrite, a regex map used by root or log_format, aio together with ssi, listen lines with quic, and ssl_session_cache shared without ssl_session_ticket_key.

The rewrite-module overflow NGINX patched in May, CVE-2026-42945, was being exploited within days of disclosure, VulnCheck found. This is NGINX’s eighth security release of 2026.

F5 credits Matt Suiche of Tolmo and Mateusz Gierblinski with the map flaw, Hansol Lee of GOTROOT with the HTTP/3 flaw, PhiNode Labs with the TLS flaw, and a researcher it names as Cyberlanc3r with the AIO flaw.

F5 found the alias flaw itself. NGINX also released njs 1.0.2 the same day, fixing two medium-severity XML-handling flaws in its JavaScript module, CVE-2026-101025 and CVE-2026-101019.