On October 14, nginx released stable 1.30.6 and mainline 1.31.7 together, fixing five security vulnerabilities at once. It comes just a month after 1.30.5 on September 15, and this is a different set of flaws. nginx.org's security advisories page labels all five medium; however, in the CVE records F5 scores three of them at CVSS 3.1 8.1 (CVSS v4 9.2), so don't stop at the word "medium".

Five Flaws and What Triggers Each

  • CVE-2026-15176 (affects 0.1.29–1.31.6): a buffer overflow might occur in a worker process when using the alias directive if the request URI was changed by the rewrite directive and then mapped to a file path. F5 score 8.1.
  • CVE-2026-93479 (affects 1.30.0–1.30.5 and 1.31.2–1.31.6): a buffer overflow might occur while evaluating string expressions with variables, affecting document root calculation and request logging in the http and stream modules. F5 score 8.1.
  • CVE-2026-95101 (affects 1.25.0–1.31.6): with HTTP/3, part of an unknown frame might be treated as the request body, which might bypass the client_max_body_size limit or inject data into the proxied request.
  • CVE-2026-97629 (affects 1.23.2–1.31.6): with TLS session ticket key rotation, one of the keys was left uninitialized, which might allow a session to be forged.
  • CVE-2026-97205 (affects 0.8.11–1.31.6): with asynchronous file I/O (AIO), a use-after-free might occur in certain configurations if an SSI page has include virtual commands. F5 score 8.1.

How to Check and Upgrade

  • Check the version with nginx -v, dump the full configuration with nginx -T, and search it for alias, rewrite, ssi on, aio and listen ... quic (HTTP/3).
  • If you use the official nginx.org repositories, upgrade stable to 1.30.6 and mainline to 1.31.7 or later (1.31.8, a regular update, followed on October 21). Run sudo nginx -t to test the configuration first, then restart or reload.
  • If you use your distribution's nginx: Debian 13 is fixed by DSA-6575-1 (1.26.3-3+deb13u10); as of October 26, Debian 12 is still listed as unfixed on the security tracker, and most of these are still marked needs-triage for 22.04 / 24.04 on Ubuntu's CVE pages. An old distribution version is not automatically safe — two of the five go back to the 0.x days. Until a package lands, check whether you use any of the configurations above.

Also Worth Knowing

njs 1.0.2 came out the same day with fixes for two XML-related vulnerabilities (CVE-2026-101025 and CVE-2026-101019); upgrade it too if you use the njs module. If your site runs nginx with PHP, PHP's critical October 21 fixes are more urgent — ideally handle both together. For basic nginx setup see hosting your first website with Nginx, for HTTPS see setting up Let's Encrypt SSL, and if the site returns 502 / 504 after the upgrade, follow the 502 / 504 troubleshooting guide.