- Last verified
- 31 Oct 2026
- CVE
- CVE-2026-15176, CVE-2026-93479, CVE-2026-95101, CVE-2026-97629, CVE-2026-97205
- Status
- Fixed in NGINX 1.30.6 and 1.31.7. Exposure depends on configuration.
What happened
NGINX released 1.30.6 (stable) and 1.31.7 (mainline) with fixes for five vulnerabilities. The nginx.org advisories rate all five as medium, because each one needs a specific feature or configuration. Other vendors score some of them higher, so read the advisory for your product before you decide how urgent this is.
| CVE | What it is | Needs this feature | Vulnerable |
|---|---|---|---|
| CVE-2026-15176 | Buffer overflow | alias used together with rewrite |
0.1.29 to 1.31.6 |
| CVE-2026-93479 | Buffer overflow in script evaluation | Script evaluation in config | 1.31.2 to 1.31.6 and 1.30.0 to 1.30.5 |
| CVE-2026-95101 | Request body injection | HTTP/3 | 1.25.0 to 1.31.6 |
| CVE-2026-97629 | Session forgery | TLS session tickets | 1.23.2 to 1.31.6 |
| CVE-2026-97205 | Use after free | Asynchronous file I/O (aio) |
0.8.11 to 1.31.6 |
Sources do not fully agree on every version range, so check the nginx.org page for the exact numbers before you report on your fleet.
Find out if you are exposed
Two questions matter: which NGINX version runs where, and does the config use the affected feature.
# Version on a host
nginx -v
# Version inside an image
docker run --rm your-image:tag nginx -v
# Features in the loaded config
nginx -T 2>/dev/null | grep -nE '^\s*(alias|aio|ssl_session_tickets|http3|listen .*quic)'
If the grep finds nothing, you are less exposed, but still upgrade. Version checks are cheap and config drifts.
What to do
- Upgrade to 1.30.6 or 1.31.7 or newer. Rebuild any container image that bundles NGINX and redeploy it. A new tag in a registry does nothing until pods restart.
- If you cannot upgrade today, switch off the feature the CVE needs where your service allows it, for example HTTP/3 or
aio. Read the advisory first, and test the change in staging. - Reload and verify. After the upgrade, run
nginx -vagain on the running container or host. A system that looks upgraded keeps running the old binary until the process restarts.
Kubernetes ingress needs a separate check
Your NGINX version is not always yours to pick. Ingress controllers ship their own build.
kubectl get pods --all-namespaces --selector app.kubernetes.io/name=ingress-nginx
- Community ingress-nginx: Kubernetes SIG Network and the Security Response Committee announced its retirement in November 2025. Read the announcement for the exact schedule. A retired project does not give you a patch for this release. Plan the move to Gateway API or a supported controller.
- F5 NGINX Ingress Controller and other products: Check the vendor advisory for a fixed build. Some products need their own patched release, not just a newer NGINX.
- Managed gateways and CDNs: Ask your provider whether and when they patched.
How we can help
We inventory every NGINX in an estate, including the ones inside images and ingress controllers, and plan the migration away from retired controllers. Book a call from the button below.