Infrastructure, domains & the recurring invoice of civilisation

The Hosting Times

Independent reporting on web hosting, domains and the infrastructure behind the internet.

Hosting

NGINX Security Fixes Put HTTP/3, TLS and Proxy Configurations on Patch List

October 20, 2026 ·
Original Hosting Ledger illustration showing NGINX security patches, reverse proxy and TLS

NGINX has released security fixes across its mainline and stable open-source branches for five flaws affecting request handling, TLS sessions and worker processes. For web hosts running NGINX as a reverse proxy or front-end server, the important question is which configurations and package versions are actually in production.

The upstream 1.31.7 changelog, dated October 14, and the matching 1.30.6 stable changelog list the same five security fixes. NGINX’s security advisory index rates each of these open-source issues medium and identifies 1.31.7 and 1.30.6 as non-vulnerable versions. A separate BleepingComputer report describes F5’s out-of-band NGINX patch response; operators should use their own edition and distributor’s advisory to choose the appropriate build rather than assume that upstream and commercial severity labels or package numbers are interchangeable.

Two of the fixes address possible worker-process buffer overflows: one involving alias after a rewrite of the request URI (CVE-2026-15176), and another during variable-based string evaluation that can affect document-root calculation and logging (CVE-2026-93479). The HTTP/3 issue (CVE-2026-95101) could treat part of an unknown frame as request-body data, potentially bypassing client_max_body_size or injecting data into a proxied request, according to the release notes.

The other two advisories concern a key left uninitialized during TLS session-ticket rotation, which could permit session forgery (CVE-2026-97629), and a possible use-after-free with asynchronous file I/O and SSI include virtual in certain configurations (CVE-2026-97205). These are conditional descriptions, not evidence that every NGINX installation is exploitable or that attacks are underway.

Operator takeaway: inventory the NGINX version actually serving traffic, including host packages, containers and managed proxies; check whether the affected directives and features are enabled; obtain the fixed package from your vendor or distribution; and reload or restart workers after deploying it. Confirm the running version after rollout, not just the version available in the package repository. Hosts that terminate TLS or proxy HTTP/3 should pay particular attention to the configurations called out in the advisories.

Sources: NGINX security advisories; NGINX 1.31.7 release notes; NGINX 1.30.6 release notes; BleepingComputer.