NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks

[Starburst-David]

NGINX released versions 1.30.6 and 1.31.7 on October 14 to fix five vulnerabilities, one of them present in every release since May 2005.

There are three memory bugs that F5, the company behind NGINX, says could crash a worker process or possibly let an attacker run code, and each requires a specific configuration to exploit.

A fourth lets an attacker forge a TLS session that could get past client-certificate checks, though F5 calls the forgery non-deterministic and beyond the attacker's control. The fifth lets an HTTP/3 client slip extra bytes into a request that NGINX passes on to a backend.

None of the five was in CISA's Known Exploited Vulnerabilities catalog as of October 15, and neither NGINX nor F5 reports attacks. NGINX rates all five medium. F5 scores the three memory bugs 9.2, Critical, on CVSS v4.0, the TLS flaw 8.3, and the HTTP/3 flaw 6.9.

Read More: https://thehackernews.com/2026/10/nginx ... sible.html

Published Date: Oct 15, 2026

Vulnerabilities has been mentioned in this article:
CVE-2026-97629 CVE-2026-97205 CVE-2026-95101 CVE-2026-93479 CVE-2026-15176 CVE-2026-101025 CVE-2026-101019 CVE-2026-42533 CVE-2026-42945 CVE-2025-23419