nginx 1.31.7 and 1.30.6 fix five flaws, one present since 2005

nginx 1.31.7 and 1.30.6 fix five flaws, one present since 2005

14 October 2026: The nginx project has released 1.31.7 on its mainline branch and 1.30.6 on its stable branch, fixing five memory and protocol flaws in the web server. The oldest, CVE-2026-15176, is a buffer overflow in a worker process that every release from 0.1.29, published in 2005, carries when the alias directive is combined with a rewrite. nginx rates all five medium and lists 1.31.7 and 1.30.6 as the first releases that are not vulnerable to any of them.

Not yet independently verified. nginx rates all five flaws medium and gives no CVSS scores; it says nothing about exploitation. The suggestion that the alias flaw can lead to code execution comes from press coverage, not from nginx. We will update this when it can be confirmed, and remove this note.

Five flaws and the configurations they need

Each flaw depends on a feature being in use, which is how a server administrator can judge exposure before patching:

• CVE-2026-15176, alias with rewrite: a buffer overflow when a request URI changed by rewrite is then mapped to a file path through alias. Vulnerable 0.1.29 to 1.31.6.
• CVE-2026-93479, script evaluation: a buffer overflow while evaluating string expressions with variables, which touched document root calculation and request logging in both the http and stream modules. Vulnerable only in the newest lines, 1.31.2 to 1.31.6 and 1.30.0 to 1.30.5.
• CVE-2026-95101, HTTP/3: part of an unknown frame could be treated as the request body, which could bypass client_max_body_size or inject data into the proxied request. Vulnerable 1.25.0 to 1.31.6.
• CVE-2026-97629, TLS session tickets: with ticket key rotation one key was left uninitialised, which might let an attacker forge a session. Vulnerable 1.23.2 to 1.31.6.
• CVE-2026-97205, asynchronous file I/O: a use-after-free when AIO is on and an SSI page uses include virtual. Vulnerable 0.8.11 to 1.31.6.

nginx credits Matt Suiche of Tolmo Inc., Hansol Lee of GOTROOT, PhiNode Labs and a researcher known as cyberlancer.

Other changes in the same release

The mainline release is more than a security fix. The http and stream GeoIP modules now read databases in the MaxMind DB format, backend SSL certificates can be verified by IP address, and QUIC supports reconfiguration and binary upgrade with quic_bpf. One change alters behaviour: the HTTP/2 module now uses the RFC 9218 prioritisation scheme and ignores RFC 7540 priority signals, which matters to anyone who tuned clients around the old scheme.

Bug fixes cover a worker crash when a cached X-Accel-Redirect response was served, a crash in the dav module with COPY and MOVE under alias, and connections reset without close_notify being logged as clean shutdowns.

Where a quick audit should start

Servers that use alias inside a location that also rewrites, terminate HTTP/3, or rotate session ticket keys are the ones to move first. Distribution packages usually backport such fixes under their own version numbers, so the package changelog, not the nginx version string, is the thing to check on Debian, Ubuntu or Red Hat systems. The previous release, 1.31.6 on 15 September, fixed a separate HTTP/3 heap overflow, CVE-2026-90439.

We list NGINX Plus, F5's commercial build, in our load balancing software category of 12 products, and F5 itself.

Sources

• nginx: security advisories, 14 October 2026
• nginx: CHANGES, changes with nginx 1.31.7, 14 October 2026
• The Hacker News: nginx fixes five flaws, 15 October 2026