NGINX Fixes Five Flaws, Including Possible Code Execution and TLS Client-Certificate Bypass
Summary
NGINX 1.30.6 and 1.31.7 fix five flaws that could crash worker processes, possibly enable code execution, bypass client-certificate checks, or pass extra HTTP/3 bytes to a backend. Upgrade to a fixed release; older branches may remain affected.
Key points
- The five flaws affect NGINX configurations using an alias with rewrite, regex map, AIO with SSI, a shared TLS session cache, or HTTP/3.
- Three memory bugs could crash a worker process or possibly enable code execution; each requires a specific configuration.
- A TLS session-ticket flaw could allow forged sessions to bypass client-certificate checks, though F5 says the forgery is non-deterministic and beyond an attacker's control.
- An HTTP/3 parsing flaw could pass extra bytes to a backend outside the client_max_body_size check.
- NGINX rates all five flaws medium; F5 assigns the three memory bugs CVSS v4.0 scores of 9.2, the TLS flaw 8.3, and the HTTP/3 flaw 6.9.
- NGINX recommends upgrading to 1.30.6 or 1.31.7. Older branches such as 1.28 remain within affected ranges; distribution packages depend on backported fixes.
- As of October 15, the flaws were not listed in CISA's Known Exploited Vulnerabilities catalog, and NGINX and F5 reported no attacks.
Article Details
- Vulnerability Types
- Memory corruption and buffer overflows
- TLS session-ticket key rotation flaw allowing possible forged sessions
- HTTP/3 request parsing flaw that can pass extra bytes to a backend
- Severity
- NGINX rates all five vulnerabilities medium. F5 assigns CVSS v4.0 scores of 9.2 (Critical) to the three memory bugs, 8.3 to the TLS flaw, and 6.9 to the HTTP/3 flaw.
- Affected Versions
- NGINX 1.30.0 through 1.30.5
- NGINX 1.31.2 through 1.31.6
- NGINX branches older than 1.30 remain affected if they are within the advisories' affected ranges and have not received backported fixes
- Exploitation Status
- reported
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Use NGINX's recommended shared TLS session cache configuration and request buffering.
- For the map flaw, use named captures as a workaround; the article says this leaves a narrower path open and upgrading is the only complete fix.
- Consult F5's advisories for the workaround applicable to each flaw.
CVE
CVE-2026-42533The map flaw, CVE-2026-93479, is in the string-handling code that NGINX patched on July 15 for CVE-2026-42533, a heap overflow F5 scored 9.2 that is reached through a regex map's captures.CVE-2026-42945The rewrite-module overflow NGINX patched in May, CVE-2026-42945, was being exploited within days of disclosure, VulnCheck found. This is NGINX's eighth security release of 2026.CVE-2026-93479The map flaw, CVE-2026-93479, is in the string-handling code that NGINX patched on July 15 for CVE-2026-42533, a heap overflow F5 scored 9.2 that is reached through a regex map's captures.
People
Cyberlanc3rResearcher credited by F5 with the AIO flaw.Hansol LeeCredited by F5 with the HTTP/3 flaw.Mateusz GierblinskiCredited by F5 with the map flaw.Matt SuicheCredited by F5 with the map flaw.Stan ShawResearcher who told The Hacker News that switching to named captures left a narrower path open for the map flaw and that upgrading was the only complete fix.
Vendors
Products
F5's Ingress ControllerNGINX Plus customers, and users of F5's Ingress Controller, Gateway Fabric, Instance Manager and WAF products, should check F5's advisories, which list affected builds and, for several products, no fixed build as ofGateway FabricNGINX Plus customers, and users of F5's Ingress Controller, Gateway Fabric, Instance Manager and WAF products, should check F5's advisories, which list affected builds and, for several products, no fixed build as ofInstance ManagerNGINX Plus customers, and users of F5's Ingress Controller, Gateway Fabric, Instance Manager and WAF products, should check F5's advisories, which list affected builds and, for several products, no fixed build as ofNGINXNGINX released versions 1.30.6 and 1.31.7 on October 14 to fix five vulnerabilities, one of them present in every release since May 2005.NGINX PlusNGINX Plus customers, and users of F5's Ingress Controller, Gateway Fabric, Instance Manager and WAF products, should check F5's advisories, which list affected builds and, for several products, no fixed build as ofnjsF5 found the alias flaw itself. NGINX also released njs 1.0.2 the same day, fixing two medium-severity XML-handling flaws in its JavaScript module, CVE-2026-101025 and CVE-2026-101019.WAFNGINX Plus customers, and users of F5's Ingress Controller, Gateway Fabric, Instance Manager and WAF products, should check F5's advisories, which list affected builds and, for several products, no fixed build as of
Tools
GOTROOTF5 credits Matt Suiche of Tolmo and Mateusz Gierblinski with the map flaw, Hansol Lee of GOTROOT with the HTTP/3 flaw, PhiNode Labs with the TLS flaw, and a researcher it names as Cyberlanc3r with the AIO flaw.TolmoF5 credits Matt Suiche of Tolmo and Mateusz Gierblinski with the map flaw, Hansol Lee of GOTROOT with the HTTP/3 flaw, PhiNode Labs with the TLS flaw, and a researcher it names as Cyberlanc3r with the AIO flaw.VulnCheckThe rewrite-module overflow NGINX patched in May, CVE-2026-42945, was being exploited within days of disclosure, VulnCheck found. This is NGINX's eighth security release of 2026.