Anyone running the nginx web server should be on version 1.30.6 (stable) or 1.31.7 (mainline). The nginx project shipped both releases on October 14, 2026, fixing five vulnerabilities, and Hong Kong's HKCERT followed with a bulletin on October 21 warning that a remote attacker could exploit some of them for remote code execution, denial of service, security restriction bypass or information disclosure. HKCERT rates the set medium risk.
nginx is widely deployed as a web server, reverse proxy and load balancer, so even medium-rated bugs in it deserve a scheduled patch. Several of these reach back many years, which means long-lived servers that never get upgraded are the ones most likely to be exposed.
Five bugs, each tied to a specific feature
The project's release notes and security advisories page describe each flaw in a single line and rate all five medium. No CVSS scores are listed there. In the order nginx lists them:
- CVE-2026-15176, a buffer overflow when using alias with rewrite. Vulnerable: 0.1.29 to 1.31.6.
- CVE-2026-93479, a buffer overflow when evaluating string expressions with variables. Vulnerable: 1.31.2 to 1.31.6 and 1.30.0 to 1.30.5.
- CVE-2026-95101, request body injection in HTTP/3. Vulnerable: 1.25.0 to 1.31.6.
- CVE-2026-97629, session forgery when using TLS session ticket key rotation. Vulnerable: 1.23.2 to 1.31.6.
- CVE-2026-97205, a use-after-free when using ngx_http_ssi_module with asynchronous file I/O (AIO). Vulnerable: 0.8.11 to 1.31.6.
Each one depends on a particular feature or configuration being in use, such as HTTP/3, server-side includes with AIO, or TLS session ticket key rotation. The advisories do not go further into how the bugs could be exploited, and neither nginx nor HKCERT reports any exploitation in the wild.
The same day, the project also released njs 1.0.2, its JavaScript module, fixing a memory exhaustion bug when parsing malformed XML (CVE-2026-101025) and inconsistent XML attribute values affecting signed XML validation (CVE-2026-101019). Sites that use njs for XML handling should update it as well.
Upgrade to 1.30.6 or 1.31.7
The fix is an upgrade: 1.30.6 on the stable branch or 1.31.7 on mainline. If you take nginx from a Linux distribution or a container base image, check that your vendor has shipped builds carrying these fixes rather than assuming the version number tells the whole story, since distributions often backport patches. Until you can upgrade, auditing which of the affected features your configuration actually enables tells you how urgent each bug is for you.
Edge software rarely fails loudly, and patching it only works if someone tracks the less glamorous advisories too, and a recent Japanese breach showed that patching an edge device is not always enough on its own. A week-old medium-rated nginx release is exactly the kind of update that quietly slips down the list.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.