NGINX Patches Five Flaws, Including a TLS Bug That Could Let Attackers Bypass Client-Certificate Checks

NGINX rolled out versions 1.30.6 and 1.31.7 on October 14, closing five vulnerabilities - one of which has been present in every release since May 2005.

Three of the bugs are memory issues that F5, the company behind NGINX, says could crash a worker process or potentially allow code execution, though each needs a specific configuration to exploit. A fourth permits an attacker to forge a TLS session that could slip past client-certificate verification, which F5 describes as non-deterministic and beyond the attacker's control. The fifth lets an HTTP/3 client inject extra bytes into a request that NGINX forwards to a backend.

As of October 15, none of the five appeared in CISA's Known Exploited Vulnerabilities catalog, and neither NGINX nor F5 reported any attacks. NGINX rates all five medium, while F5 scores the three memory bugs 9.2 Critical on CVSS v4.0, the TLS flaw 8.3, and the HTTP/3 flaw 6.9.

Every flaw requires a directive the administrator added: an alias with a rewrite, a regex map, AIO with SSI, a shared TLS session cache, or HTTP/3. NGINX's own documentation recommends the shared session cache and request buffering, and the other condition for the HTTP/3 flaw is on by default.

The TLS flaw lives in the automatic rotation of session ticket keys. Since version 1.23.2, a shared session cache makes NGINX generate and rotate those keys itself unless they are loaded from a file. Each worker keeps three key slots, but rotation copied only two, leaving the third holding uninitialized memory - and a ticket naming that slot could be verified and decrypted with it, "allowing a forged session," according to the fix commit. The exposed setting, ssl_session_cache shared:SSL:10m, is the one used in NGINX's example configuration. NGINX fixed a session-reuse flaw with the same consequence, CVE-2025-23419, in February 2025.

The map flaw, CVE-2026-93479, sits in string-handling code NGINX patched on July 15 for CVE-2026-42533. A July patch added protection against overrunning a buffer, but data could still spill into a reserved area, and a second patch then sized the final string from that spilled length. The overflow is at most the size of the reserved area on the document-root path and a single null byte on the access-log path. F5's July workaround had already drawn scrutiny: researcher Stan Shaw told The Hacker News that switching to named captures left a narrower path open and that upgrading was "the only complete fix."

The alias flaw opens after a rewrite changes a request's URI and before NGINX selects the next location; if anything reads $request_filename in that window, mapping the URI to a file path can overflow a buffer. The AIO flaw is an unchecked 8-bit counter - 256 pending asynchronous operations wrap it to zero, and the request can be freed while those operations still point at its memory, with SSI pages using include virtual commands as the trigger. The HTTP/3 flaw came from one parser field serving two purposes, so when an unknown frame was split across two reads, the leftover count was treated as body and sent to the backend, outside the client_max_body_size check.

Upgrading to 1.30.6 on stable or 1.31.7 on mainline is the recommended path; older branches such as 1.28 remain affected, and distribution packages are fixed only if patches were backported. NGINX Plus customers and users of F5's Ingress Controller, Gateway Fabric, Instance Manager and WAF products should check F5's advisories. Those who cannot upgrade can apply F5's workarounds, and running nginx -T will show which exposed directives are active.

The rewrite-module overflow NGINX patched in May, CVE-2026-42945, was exploited within days of disclosure, according to VulnCheck. This marks NGINX's eighth security release of 2026. F5 credits Matt Suiche of Tolmo and Mateusz Gierblinski with the map flaw, Hansol Lee of GOTROOT with the HTTP/3 flaw, PhiNode Labs with the TLS flaw, and a researcher it names as Cyberlanc3r with the AIO flaw; F5 found the alias flaw itself. NGINX also released njs 1.0.2 the same day, fixing two medium-severity XML-handling flaws, CVE-2026-101025 and CVE-2026-101019.

Source: The Hackers News