On October 14, 2026, nginx released versions 1.30.6 and 1.31.7 with five security fixes. The flaws sit in features such as HTTP/3, TLS sessions and folder aliases. Any site served by nginx is affected, whether on your own server or on a hosting plan.
What we know
- The releases: per nginx.org, 1.30.6 is the stable line and 1.31.7 the mainline. They fix all five flaws.
- The five flaws, per the official advisories page:
- CVE-2026-15176: buffer overflow when using `alias` with `rewrite`. Affects 0.1.29 through 1.31.6.
- CVE-2026-93479: buffer overflow when evaluating expressions with variables. Affects 1.30.0 through 1.30.5 and 1.31.2 through 1.31.6.
- CVE-2026-95101: request body injection in HTTP/3. Affects 1.25.0 through 1.31.6.
- CVE-2026-97629: TLS session forgery when nginx rotates session ticket keys on its own. Affects 1.23.2 through 1.31.6.
- CVE-2026-97205: use-after-free with the SSI module and AIO. Affects 0.8.11 through 1.31.6.
- Severity: nginx rates all five as medium. According to The Hacker News, F5, which owns nginx, scores three of them 9.2 out of 10.
- njs: njs 1.0.2, nginx's JavaScript module, shipped the same day with two XML-handling fixes.
- Attacks: according to The Hacker News, neither nginx nor F5 reported attacks as of October 15.
What changes and what doesn't
What changes is the minimum safe version: 1.30.6 or 1.31.7. Older lines such as 1.28 get no fixes from nginx.org.
Not every server is exposed to all five: each flaw depends on a specific configuration feature. And if nginx comes from your operating system's packages, the version number may not change even after the fix is applied.
How to tell if it affects you
- Shared hosting: you can't update nginx yourself. Ask your provider whether its servers run nginx 1.30.6 or 1.31.7, or carry the fix for these five CVEs.
- VPS or your own server: run `nginx -v`. If it is older than 1.30.6 and came from nginx.org, update.
- If nginx came from your distribution (Ubuntu, Debian, AlmaLinux), update through its package manager and check its security tracker for these CVEs.
- Check what you use. `nginx -T` prints the full configuration. Look for `alias`, `aio`, `ssi`, `http3` or `quic`, and `ssl_session_cache shared` without `ssl_session_ticket_key`. If they show up, that server is more urgent.
- Reload after updating and confirm the site loads and the certificate is still valid.
Related: Let's Encrypt Cuts Certificates to 64 Days: What to Check
Sources
- nginx.org, news of October 14, 2026
- nginx.org, security advisories
- nginx.org, njs security advisories
- The Hacker News, October 15, 2026
Updates: if attacks using these flaws appear or distributions publish their patches, it will be added here with a link.