Full Report
NGINX released versions 1.30.6 and 1.31.7 on October 14 to fix five vulnerabilities, one of them present in every release since May 2005. There are three memory bugs that F5, the company behind NGINX, says could crash a worker process or possibly let an attacker run code, and each requires a specific configuration to exploit. A fourth lets an attacker forge a TLS session that could
Analysis Summary
# Vulnerability: Multiple NGINX Flaws Including Critical RCE and TLS Forgery
## CVE Details
- **CVE ID:** CVE-2026-15176, CVE-2026-93479, CVE-2026-97205, CVE-2026-95101, CVE-2026-97629
- **CVSS Score:** 9.2 (Critical) for memory bugs; 8.3 (High) for TLS bug; 6.9 (Medium) for HTTP/3 bug.
- **CWE:** Includes Heap Overflow (CWE-122), Use-After-Free (CWE-416), and Uninitialized Variable (CWE-457).
## Affected Systems
- **Products:** NGINX Open Source, F5 NGINX Plus.
- **Versions:**
- **CVE-2026-15176:** 0.1.29 to 1.31.6
- **CVE-2026-97205:** 0.8.11 to 1.31.6
- **CVE-2026-97629:** 1.23.2 to 1.31.6
- **CVE-2026-95101:** 1.25.0 to 1.31.6
- **CVE-2026-93479:** 1.30.0 to 1.30.5 and 1.31.2 to 1.31.6
- **Configurations:** Each flaw requires specific directives (e.g., `alias` with `rewrite`, `aio` with SSI, `ssl_session_cache shared`, or `HTTP/3`).
## Vulnerability Description
NGINX addressed five distinct vulnerabilities on October 14, 2026. The most severe involve three memory corruption flaws (Heap Overflows and Use-After-Free) that can lead to worker process crashes or potential Remote Code Execution (RCE).
- **CVE-2026-97629 (TLS Forgery):** A flaw in automatic session ticket key rotation. When using a shared session cache, NGINX failed to initialize the third key slot during rotation. This uninitialized memory could allow an attacker to non-deterministically forge a TLS session, potentially bypassing client-certificate authentication.
- **CVE-2026-95101 (HTTP/3 Injection):** Allows an HTTP/3 client to inject extra bytes into a proxied request or bypass `client_max_body_size` when request buffering is enabled.
## Exploitation
- **Status:** Not currently exploited in the wild; no public PoC reported as of October 15.
- **Complexity:** Medium to High (Exploitation of memory bugs and TLS forgery requires specific conditions and, in some cases, is non-deterministic).
- **Attack Vector:** Network.
## Impact
- **Confidentiality:** High (Potential for RCE and bypassing certificate checks).
- **Integrity:** High (Potential for RCE and request injection).
- **Availability:** High (Worker process crashes/DoS).
## Remediation
### Patches
- Upgrade to **NGINX 1.30.6** (Stable branch) or **1.31.7** (Mainline branch).
### Workarounds
- **For CVE-2026-15176:** Remove `alias` directives or avoid using `$request_filename`.
- **For CVE-2026-97205:** Disable `aio` or stop serving SSI pages.
- **For CVE-2026-95101:** Set `proxy_request_buffering off;`.
- **For CVE-2026-97629:** Remove `ssl_session_cache shared:...` or use `ssl_session_ticket_key` to load keys from a file.
## Detection
- **Indicators of Compromise:** Unusual worker process segmentation faults (logs) or unexpected bypasses of client-certificate authentication.
- **Detection methods:** Review NGINX configuration files for the specific vulnerable directives mentioned in the "Affected Systems" section.
## References
- NGINX Security Advisories: [https://nginx.org/en/security_advisories.html]
- F5 Advisory (CVE-2026-15176): [https://my.f5.com/manage/s/article/K000162416]
- NGINX GitHub Fix Commit: [https://github.com/nginx/nginx/commit/1916f26e6ca49296568633d309777e36527e5bb2]