Your NGINX web servers have new overflow fixes. Upgrade before someone tests your config for you

NGINX sits in front of a large share of the web, often in places nobody remembers configuring. On October 14 the project shipped 1.31.7 and 1.30.6 with fixes for five security bugs, and F5 calls two of them critical.

Nobody has reported attacks. The catch is that whether you are exposed depends on how each server block is written, so the quick answer is to upgrade.

Whether your NGINX is exposed depends on a config file someone wrote years ago. Upgrading is faster than reading it.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

NGINX 1.31.7 fixes five security bugs

CVE-2026-15176 is a buffer overflow in a worker process when the alias directive serves a request whose URI was changed by rewrite. CVE-2026-93479 is an overflow while evaluating string expressions with variables, which touches document root calculation and request logging. Both are fixed in 1.31.7 and 1.30.6.

The same release fixes CVE-2026-97205, a use-after-free with asynchronous file I/O and SSI include virtual; CVE-2026-95101, an HTTP/3 flaw that can slip data past client_max_body_size into proxied requests; and CVE-2026-97629, an uninitialized TLS session ticket key that could allow session forgery.

Configs with alias and rewrite are the ones exposed

SecurityWeek reports that F5 rates CVE-2026-15176 and CVE-2026-93479 critical and says an unauthenticated attacker can trigger them with crafted HTTP requests. In most cases that crashes and restarts the worker. Code execution needs ASLR to be off or bypassed. The nginx.org advisory list rates each bug medium.

CVE-2026-15176 reaches back to nginx 0.1.29, so almost every install with an alias plus rewrite setup is in range. Distribution packages, container base images and appliances that bundle NGINX update on their own schedule, which is where old builds tend to hide.

Upgrade NGINX to 1.30.6 or 1.31.7

• Upgrade NGINX Open Source to 1.31.7 (mainline) or 1.30.6 (stable), or the distribution package that backports these CVEs.
• Rebuild container images that use an nginx base image and redeploy them.
• Search configs for locations that combine alias with rewrite, and for aio with SSI, and upgrade those servers first.
• Ask vendors of appliances and ingress controllers that embed NGINX for their fixed release.

Details

• CVE-2026-15176: buffer overflow with alias after rewrite; vulnerable 0.1.29 to 1.31.6. F5 advisory K000162416, October 14, 2026.
• CVE-2026-93479: buffer overflow in script evaluation; vulnerable 1.31.2 to 1.31.6 and 1.30.0 to 1.30.5.
• Also fixed: CVE-2026-97205 (AIO use-after-free), CVE-2026-95101 (HTTP/3 request body injection), CVE-2026-97629 (TLS session ticket forgery).
• Fixed: 1.31.7 and 1.30.6. Not reported as exploited.

Hunt / verify

• Worker process crashes (exited on signal 11) in the NGINX error log since October 14.
• Run nginx -V on each host and container to confirm the running version, not just the installed package.
• Requests with unusual rewritten paths hitting alias locations.

Source: nginx security advisories; nginx CHANGES 1.31.7; F5 K000162416

Sources

• nginx.org: nginx security advisories
• nginx.org: Changes with nginx 1.31.7
• F5: K000162416, NGINX ngx_http_core_module vulnerability CVE-2026-15176
• SecurityWeek: F5, Juniper Networks Patch Critical Vulnerabilities
• CVE.org: CVE-2026-15176

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].