Each of the five NGINX flaws fixed on October 14 needs a directive the admin added
NGINX 1.30.6 and 1.31.7, released October 14, fix five flaws, three of them memory bugs that F5 scores 9.2 Critical on CVSS v4.0. F5 scores a fourth, in TLS session handling, at 8.3; it may let a forged session past client-certificate checks.
The Watch · Security desk
Bar comparison of F5's CVSS v4.0 scores: the three memory bugs score 9.2 each, Critical; the TLS flaw scores 8.3; the HTTP/3 flaw scores 6.9.
F5's CVSS v4.0 score, per flaw In CVSS v4.0
| Item | Value | Claim |
|---|---|---|
| Memory bugs (three), each | 9.2 CVSS v4.0 | 4 |
| TLS flaw | 8.3 CVSS v4.0 | 4 |
| HTTP/3 flaw | 6.9 CVSS v4.0 | 4 |
What happened
- The TLS flaw sits in ticket key rotation: each worker keeps three key slots, rotation copied only two, and the third held leftover memory.
- The map flaw, CVE-2026-93479, is in string-handling code NGINX patched on July 15 for CVE-2026-42533, a heap overflow F5 also scored 9.2.
- The HTTP/3 flaw lets a client slip extra bytes into a request that NGINX passes to a backend, outside the client_max_body_size check.
- As of October 15, none of the five was in CISA's Known Exploited Vulnerabilities catalog, and neither NGINX nor F5 reports attacks.
Why it matters
- exposure Sites that gate access on client certificates should be checked first. The TLS flaw targets that verification, and its trigger is the setting NGINX's documentation uses in its example configuration.
- contradiction NGINX rates all five medium while F5 scores three of them 9.2 Critical. The score cannot rank a fleet; a match between the config and the trigger can.
- decision Triage is per server. Searching each config for an alias with rewrite, a regex map, AIO with SSI, a shared session cache and HTTP/3 sorts the fleet into patch-first and patch-on-schedule.
- constraint A July patch does not clear the map flaw. The affected range starts before the July change, so servers already updated once still need this release.
We would check the TLS flaw first. Ticket key rotation has been automatic since 1.23.2, from October 2022, whenever a shared session cache is configured and no key file is loaded [9]. F5 says the forgery works "in a non-deterministic manner that is beyond the attacker's control" [11]. The randomness limits the forgery, but F5 still says an attacker could use it to bypass verification of client certificates [11]. In February 2025, NGINX patched CVE-2025-23419, an earlier session-reuse bug that had the same effect [13].
The map flaw has the clearest limits. According to the fix commit, on the document-root path the overflow can be no larger than the reserved area, and on the access-log path it is one null byte [16]. The commit says the overflow became possible after a July change. One patch added a guard against buffer overruns but still let data run into a reserved area. A second patch then used that overflowed length to size the final string [15]. From the July 15 patch to the October 14 release is 91 days [25].
F5's July workaround for the earlier overflow already had doubters. In July, researcher Stan Shaw said to The Hacker News that moving to named captures narrowed the path without closing it [18], and that upgrading was "the only complete fix" [19].
The alias and AIO bugs each stack several conditions. The alias flaw lives in the gap between a rewrite altering a request's URI and NGINX choosing the next location. A read of $request_filename during that gap, with a location prefix longer than the rewritten URI, overflows a buffer when NGINX maps the URI to a file path [20]. The AIO problem is a counter. Every pending asynchronous operation increments an unchecked 8-bit field; at 256 pending operations it wraps to zero, and the request can be freed while those operations still reference its memory [21]. NGINX names SSI pages that use include virtual commands as the trigger, because they can run their included requests in parallel [22].
The HTTP/3 bug comes from one parser field doing two jobs: tracking how much of an unknown frame was left to skip, and counting the DATA bytes to forward as request body. If an unknown frame arrived split over two reads, the parser counted what was left over as body [23]. F5 scores it 6.9 [4], and its second condition is on by default [8].
One of the five has been present in every release since May 2005, according to The Hacker News. The report does not say which [2].
The fixed builds are 1.30.6 on the stable branch [24] and 1.31.7 [1].
What to watch
- Whether CISA adds any of the five to its Known Exploited Vulnerabilities catalog, or NGINX or F5 report attacks.
- Whether NGINX's medium rating and F5's 9.2 CVSS v4.0 scores are reconciled in the advisories.
- Whether working exploit code appears for the TLS session ticket flaw, since the fix commits describe its mechanics.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence62
- Adoption
- Insufficient
- Hype gap+8
- Incentives
- Insufficient
- Confidence60
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
NGINX released versions 1.30.6 and 1.31.7 on October 14 to fix five vulnerabilities.
- [2]
One of the five vulnerabilities has been present in every NGINX release since May 2005; the report does not say which one.
- [3]
Three of the flaws are memory bugs that F5 says could crash a worker process or possibly let an attacker run code, and each requires a specific configuration to exploit.
- [4]
F5 scores the three memory bugs 9.2, Critical, on CVSS v4.0, the TLS flaw 8.3, and the HTTP/3 flaw 6.9.
- [5]
NGINX rates all five flaws medium.
- [6]
None of the five was in CISA's Known Exploited Vulnerabilities catalog as of October 15, and neither NGINX nor F5 reports attacks.
- [7]
Every one of the five needs a directive the admin added: an alias with a rewrite, a regex map, AIO with SSI, a shared TLS session cache, or HTTP/3.
- [8]
NGINX's own documentation recommends the shared session cache and request buffering; the other condition for the HTTP/3 flaw is on by default.
- [9]
Since NGINX 1.23.2, from October 2022, a shared session cache makes NGINX generate and rotate TLS session ticket keys itself unless the admin loads keys from a file.
- [10]
Each worker process keeps a copy of three key slots; rotation copied only two, so the third held whatever was in memory before, and a ticket naming that slot could be verified and decrypted with uninitialized key material, 'allowing a forged session,' the fix commit says.
- [11]
F5 says the TLS forgery works 'in a non-deterministic manner that is beyond the attacker's control,' and that an attacker could use it to bypass verification of client certificates.
- [12]
The exposed setting, ssl_session_cache shared:SSL:10m, is the one NGINX's documentation uses in its example configuration.
- [13]
NGINX fixed a session-reuse flaw with the same consequence, CVE-2025-23419, in February 2025.
- [14]
The map flaw, CVE-2026-93479, is in the string-handling code that NGINX patched on July 15 for CVE-2026-42533, a heap overflow F5 scored 9.2 that is reached through a regex map's captures.
- [15]
According to the fix commit, the new overflow became possible after a change in the July release: a July patch added protection against overrunning a buffer, but data could still spill into a reserved area, and a second July patch then sized the final string from that spilled length, so the string could outgrow its buffer.
- [16]
The commit puts limits on the overflow: at most the size of the reserved area on the document-root path, and a single null byte on the access-log path.
- [17]
F5's advisory and NGINX's advisories page list 1.30.0 and 1.31.2 as the earliest affected versions for the map flaw, which come before the July change, so a server patched in July is inside the affected range either way.
- [18]
Researcher Stan Shaw told The Hacker News in July that switching to named captures, F5's July workaround, left a narrower path open.
- [19]
Stan Shaw told The Hacker News in July that upgrading was "the only complete fix."
- [20]
The alias flaw opens in the moment after a rewrite changes a request's URI and before NGINX picks the next location. If anything reads $request_filename in that window, and the location's prefix is longer than the rewritten URI, mapping the URI to a file path overflows a buffer.
- [21]
The AIO flaw is a counter: each pending asynchronous operation on a request adds one to an 8-bit field with no check, so 256 pending operations wrap it to zero and the request can be freed while those operations still point at its memory.
- [22]
NGINX names SSI pages with include virtual commands, which can run their included requests in parallel, as the trigger for the AIO flaw.
- [23]
The HTTP/3 flaw came from one parser field doing two jobs, holding the remaining length of an unknown frame being skipped and the number of DATA bytes to pass on as request body; when an unknown frame was split across two reads, the leftover count was treated as body and sent to the backend, outside the client_max_body_size check.
- [24]
The advice is to upgrade to 1.30.6 on the stable branch or to the 1.31 line.
- [25]
The span from the July 15 patch to the October 14 release is 91 days.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- thehackernews.comNGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks
1 article · October 15, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- TLS securityFollow
- Web serversFollow
- Vulnerability ManagementFollow