nginx 1.30.6 fixes five CVEs, including three 9.2 memory bugs

On October 14, nginx.org released nginx 1.30.6 (stable) and 1.31.7 (mainline) with fixes for five vulnerabilities. Three are memory-safety bugs in the worker process that F5 scores 8.1 under CVSS v3.1 and 9.2 under CVSS v4.0. The nginx project labels all five medium. None was listed as exploited or in CISA's Known Exploited Vulnerabilities catalog as of October 15, and F5 has not published proof-of-concept code.

Each bug needs a specific configuration to be reachable. A default install serving static files is unlikely to be exposed to the three memory bugs, but the TLS session flaw is triggered by a common session-cache directive.

The five CVEs and their affected version ranges

• CVE-2026-15176: heap buffer overflow when alias is used in a location whose URI was changed by rewrite. Affects 0.1.29 through 1.31.6. F5 found it internally.
• CVE-2026-93479: heap buffer overflow while evaluating string expressions with variables, which affects document root calculation and request logging. Affects 1.30.0 through 1.30.5 and 1.31.2 through 1.31.6. Reported by Matt Suiche of Tolmo.
• CVE-2026-97205: use-after-free when asynchronous file I/O (aio) is on and an SSI page contains include virtual. Affects 0.8.11 through 1.31.6.
• CVE-2026-95101: over HTTP/3, part of an unknown frame can be treated as request body. That lets a client exceed client_max_body_size or inject bytes into the request nginx proxies to the backend. Affects 1.25.0 through 1.31.6.
• CVE-2026-97629: automatic TLS session ticket key rotation left one of the keys uninitialized, which might allow a forged session. Affects 1.23.2 through 1.31.6.

For the three memory bugs, F5's advisories (K000162416, K000162607 and K000162608) describe the impact as a worker crash and restart, with code execution possible only where ASLR is disabled or the attacker can bypass it. The same day, nginx.org also shipped njs 1.0.2 with fixes for two XML-handling flaws, CVE-2026-101025 and CVE-2026-101019.

Configurations that make each bug reachable

CVE-2026-15176 requires a location that combines alias with rewrite, plus a set or return that references $request_filename. Using $request_filename in a log_format has the same effect.

CVE-2026-93479 requires a map with regex entries whose numbered captures ($1, $2) are read by root or an access log format before the map's output variable is evaluated. In July, nginx 1.30.4 and 1.31.3 fixed a different overflow in map-with-regex handling (CVE-2026-42533), so servers that skipped that release are exposed on both counts.

CVE-2026-97205 needs aio enabled and SSI pages with include virtual. SSI is uncommon on PHP sites.

CVE-2026-95101 applies only to servers with HTTP/3 enabled (a listen ... quic line) and proxy_request_buffering left at its default of on.

CVE-2026-97629 applies when ssl_session_cache shared:... is set and no ssl_session_ticket_key file is configured, because that combination turns on automatic key rotation. The line ssl_session_cache shared:SSL:10m; appears in nginx's own documentation examples. F5 says a forged session happens non-deterministically and outside the attacker's control. The practical risk falls on sites that use client-certificate authentication (ssl_verify_client), since a forged resumed session could skip that check. Servers with ssl_session_tickets off; are not affected.

Debian and Ubuntu packages are not patched yet

Most small-business servers run the distribution's nginx package, not an upstream build. On October 16, Debian's security tracker listed nginx in bookworm (1.22.1) and trixie (1.26.3) as vulnerable to all five CVEs, with a fix only in unstable (1.30.4-8). We did not find a published Ubuntu fix for any of the five at the time of writing. Until the backports arrive, apt upgrade will not close these holes. Upstream also publishes fixes only for the current stable and mainline branches, so self-compiled builds on 1.28 or older need a branch upgrade.

NGINX Plus is fixed in 37.0.5.1 and 37.1.0.1. F5 also lists affected builds of NGINX Ingress Controller (fixed in 5.7.0), NGINX Gateway Fabric (2.8.0) and NGINX Instance Manager (2.24.0).

Checking a server's running configuration with nginx -T

Run these as root. nginx -T dumps the full loaded configuration, including every included file, so the checks cover vhosts that a grep of /etc/nginx/sites-enabled would miss.

nginx -v
nginx -T 2>/dev/null > /root/nginx-full.conf

# CVE-2026-15176: alias, rewrite and $request_filename in use
grep -nE '^\s*(alias|rewrite)\s' /root/nginx-full.conf
grep -n 'request_filename' /root/nginx-full.conf

# CVE-2026-93479: regex map entries, numbered captures in root or log_format
grep -nE '^\s*~' /root/nginx-full.conf
grep -nE '^\s*(root|log_format).*\$[0-9]' /root/nginx-full.conf

# CVE-2026-97205: aio together with ssi
grep -nE '^\s*(aio|ssi)\s' /root/nginx-full.conf

# CVE-2026-95101: HTTP/3 listeners
grep -nE 'listen.*quic' /root/nginx-full.conf

# CVE-2026-97629: shared session cache without a ticket key file
grep -nE 'ssl_session_(cache|ticket_key|tickets)|ssl_verify_client' /root/nginx-full.conf

A hit on the first grep of a pair does not mean the server is vulnerable. The location block has to contain the full combination described above, so read the matching blocks by line number.

Workarounds until a fixed package is installed

• CVE-2026-15176: replace alias with root in the affected location, or remove the $request_filename reference.
• CVE-2026-93479: switch the map's numbered captures to named captures ((?<name>...)) and reference them only within the block where the regex matched.
• CVE-2026-97205: set aio off; or ssi off;. Turning off aio can slow delivery of large static files.
• CVE-2026-95101: set proxy_request_buffering off; in HTTP/3-enabled server blocks, or remove the quic listener.
• CVE-2026-97629: add ssl_session_tickets off;, or load a key from a file. A static key never rotates, so if you use one, regenerate it on a schedule.

openssl rand 80 > /etc/nginx/ticket.key
chmod 600 /etc/nginx/ticket.key
# in the http or server block:
#   ssl_session_ticket_key /etc/nginx/ticket.key;
nginx -t && systemctl reload nginx

Always run nginx -t before a reload. A syntax error caught there leaves the old workers running; one missed there takes the site down on the next restart.

Falcon Internet checks the configurations on the nginx servers we manage against each advisory's trigger conditions instead of waiting for the distribution package. After the fixed package installs, confirm the version with nginx -v and make sure a reload or restart has replaced the old worker processes; ps -o lstart= -C nginx shows when each nginx process started.