The web server running a huge slice of the internet just shipped a quiet but urgent update. NGINX fixed five security flaws in a single release. Two of them had sat in the code since 2009.
What Happened?
On October 14, the NGINX team released versions 1.31.7 and 1.30.6. Both branches carry the same five fixes. Three are memory bugs inside the worker process. One is a heap overflow that fires when alias and rewrite rules remap a URL to a file path. Another overflow occurs when NGINX evaluates variables for things like the document root and the access log. The third is a use-after-free error in asynchronous file reads. Each one can crash a server. In the worst case, each could let an attacker run code. The other two are quieter but still serious. The same release also patched two smaller flaws in njs, the NGINX scripting tool.
The Five Flaws
Five flaws, one patch. Two sat in the code since 2009.
NGINX 1.31.7 and 1.30.6 close five bugs at once. Three corrupt worker memory and can crash a server or run code. Two touch protocol and trust.
NGINX rates all five medium. Outside scorers put the three memory bugs much higher. The trigger is in your config, so patch fast and check what you actually run.
- CVE-2026-15176: the alias and rewrite overflow. Code dates to 2009.
- CVE-2026-97205: the use-after-free in async file reads. Also old code.
- CVE-2026-93479: the variable evaluation overflow in newer builds.
- CVE-2026-95101: an HTTP/3 parsing bug that can smuggle body data into a backend or slip past size limits.
- CVE-2026-97629: a TLS session ticket flaw that can forge a session and skip a client certificate check.
The Impact
NGINX rates all five as medium. The label undersells it. Outside scorers rated the three memory bugs far higher, which is reason enough not to wait on a badge. These flaws only fire under specific setups, so two servers on the same version can carry very different risk. A crash is the floor here, not the ceiling. History backs the urgency. Earlier in 2026, a separate NGINX rewrite flaw was exploited within days of going public.
How to Avoid This
- Update to 1.31.7 or 1.30.6 right away.
- Run nginx -T and read your live config.
- Flag any use of alias, rewrite, SSI, and HTTP/3.
- Rotate your TLS session ticket keys.
- Retest after you patch.
Indicators of Compromise
No published indicators of compromise exist for these flaws. CISA’s exploited vulnerabilities catalog lists none, and no attacks have been reported in the wild. So there is nothing to feed a threat hunt by hash or IP. Hunt by configuration instead. Run nginx -T, look for the risky directives above, and watch worker processes for restarts or crashes you cannot explain.
Five Flaws. Not All of Them Are Yours.
A CVE list tells you what got fixed. It does not tell you which of your servers an attacker could actually reach. That gap is where patch panic and wasted hours live.
- A Red Teammate tests which flaws are truly exploitable in your setup, not just present in your version.
- Findings route to the AppSec and Cloud teammates for governed fixes, with your team approving the consequential ones.
- Exposure gets scored by what can be used against you, not by a generic severity label.
- Log every patch and retest so you can prove the risk is closed.
- You start with one teammate and keep authority over every action.
