NGINX fixes flaws that can let attackers run code on servers without logging in

17.10.2026 vpnlab.io editorial team 4 min 28

NGINX released versions 1.30.6 (stable) and 1.31.7 (mainline) on 14 October with fixes for five vulnerabilities. Three of them are memory bugs that an attacker can trigger with crafted HTTP requests and no login. In the worst case that means running code on the server. F5, which develops NGINX, rates these three at 9.2 out of 10 (critical) on CVSS 4.0. Each of the three is only reachable with a particular configuration, so a server running NGINX is not automatically exposed. F5 says it knows of no public exploit and no attacks.

What was fixed

The three serious bugs depend on directives that are common in real configurations:

CVE	When the server is exposed	F5 score (CVSS 4.0)
CVE-2026-15176	A location uses `alias` together with `rewrite`, and `$request_filename` is used in `set`, `return` or a log format	9.2
CVE-2026-93479	A `map` uses regex matching, and `root` or the access log format reads its unnamed captures ($1, $2) before the map's own variable	9.2
CVE-2026-97205	Asynchronous file I/O (`aio`) is on and SSI pages use `include virtual`	9.2
CVE-2026-97629	`ssl_session_cache shared:...` is set without `ssl_session_ticket_key`, so NGINX rotates session ticket keys itself	8.3
CVE-2026-95101	HTTP/3 is on together with `proxy_request_buffering on`	6.9

In the first three cases the overflow crashes an NGINX worker process, which then restarts. Repeated requests can keep doing that, so at minimum this is a denial of service. Code execution, according to F5, is possible on systems where address space layout randomization (ASLR) is disabled or where the attacker can get around it. The alias bug has been in the code since version 0.1.29, released in 2005.

The session ticket bug is a different kind of problem. One of the rotated keys was left uninitialized, and F5 says an attacker could forge a TLS session and use it to get past client certificate checks. That matters for servers that admit people by certificate, such as admin panels and internal services.

Critical or medium?

The two ratings look contradictory. On the nginx.org advisories page all five bugs are marked "medium". F5's own CVE records give the three memory bugs 9.2 on CVSS 4.0 and 8.1 (high) on CVSS 3.1. The gap comes from the conditions. The CVSS vector says the attack needs no account but has high complexity, because it only works on a matching configuration. Security Affairs wrote on 16 October about eleven fixed issues. The higher count covers more than NGINX itself: on the same day F5 shipped updates for related products, including the njs scripting module, Ingress Controller and Gateway Fabric.

How to check your own server

NGINX runs in front of a lot of self-hosted services on rented servers, including VPN and proxy panels, file shares and small sites. If you run one, two commands are enough to start. nginx -v shows the version, and nginx -T | grep -nE 'alias|request_filename|aio|ssi |ssl_session_cache|ssl_session_ticket|map ' lists the directives from the table across the whole loaded configuration.

The version number alone can mislead. Debian and Ubuntu keep older NGINX versions and add security patches to them, so "1.22" or "1.26" on a server says nothing about whether the October fixes are in. On 17 October the Debian security tracker still listed the bookworm and trixie packages as vulnerable. Check your distribution's tracker and update with apt update && apt upgrade once a fixed package appears. If you use the official nginx.org packages, the fixed versions are 1.30.6 and 1.31.7.

Until a fix arrives, F5's advice is to change the configuration: avoid alias and $request_filename in affected locations, use named captures in map instead of $1 and $2, turn off aio or stop serving SSI pages, and either load ticket keys from a file with ssl_session_ticket_key or switch tickets off with ssl_session_tickets off. Our guide to hardening a VPS covers the rest of basic server hygiene.