CVE-2026-15176 / CVE-2026-93479 / CVE-2026-97205, NGINX Open Source and NGINX Plus: three unauthenticated heap-corruption flaws rated CVSS 4.0 9.2, reachable only in specific configurations and fixed in 1.30.6 and 1.31.7
Three configuration-dependent NGINX heap flaws (CVSS 9.2) are fixed in 1.30.6 and 1.31.7; Debian stable is not yet
Defender actions
- Run nginx -T on every internet-facing NGINX reverse proxy, load balancer and ingress and upgrade each one whose configuration uses alias with rewrite and $request_filename, a regex map whose captures are referenced before its output variable, or aio together with ssi, HTTP/3 or TLS session ticket key rotation to nginx 1.30.6 or 1.31.7 (NGINX Plus 37.0.5.1 or 37.1.0.1); where the package comes from Debian bookworm or trixie, which the tracker still marks vulnerable, apply F5's configuration workaround until the distribution ships a fix.
Analysis
nginx's change log for 1.30.6, dated 14 October 2026, lists five security fixes, which nginx.org's advisories page ties to 1.30.6 (stable) and 1.31.7 (mainline) (nginx.org change log, 2026-10-14; nginx.org, 2026-10-14); three of them are CVE-2026-15176, a heap buffer overflow in the core module that CCB describes as reachable where a location uses alias together with rewrite and a set or return directive referencing $request_filename, or where $request_filename appears in an access-log format; CVE-2026-93479, a heap buffer overflow in script evaluation that affects configurations whose regex map captures are referenced in root or an access-log format before the map's output variable, or that use a non-cacheable variable in a string expression; and CVE-2026-97205, a use-after-free when asynchronous file I/O is enabled, which Daily CyberSecurity relays from F5 as triggered by an SSI page with include virtual commands (Centre for Cybersecurity Belgium, 2026-10-19; Daily CyberSecurity, 2026-10-14). Each is scored CVSS 4.0 9.2 and reachable by an unauthenticated network attacker, the first two under conditions beyond the attacker's control, with CCB's warning and vector covering the first two and Daily CyberSecurity all three (Centre for Cybersecurity Belgium, 2026-10-19; Daily CyberSecurity, 2026-10-14). F5's CNA text says the overflow may restart the worker process and that attackers can execute code where ASLR is disabled or can be bypassed (Debian Security Tracker, 2026-10-20). Daily CyberSecurity reports that F5 has confirmed no public proof of concept for any of the three, and no exploitation is reported (Daily CyberSecurity, 2026-10-14). Help Net Security reports that VulnCheck flagged exploitation attempts against an earlier NGINX flaw, CVE-2026-42945, three days after the flaw and its proof of concept were public (Help Net Security, 2026-05-18). The other two are CVE-2026-95101 (with HTTP/3, part of an unknown frame might be treated as the request body, bypassing client_max_body_size or injecting data into the proxied request) and CVE-2026-97629 (with TLS session ticket key rotation, one key was left uninitialised, which might allow forging a session) (nginx.org change log, 2026-10-14); nginx.org rates all five medium (nginx.org, 2026-10-14).
Cited evidence
Security: when using TLS session ticket key rotation, one of the keys
Not vulnerable: 1.31.7+, 1.30.6+
Use-after-free when using asynchronous file I/O (AIO)
CVE-2026-93479: CVSS 9.2 (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
On systems where Address Space Layout Randomization (ASLR) is disabled or can be bypassed, an attacker could also execute code
While patching appliances or software to the newest version may protect against future exploitation, it does not remediate historic compromise.
when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing
Currently, F5 has confirmed no public proof-of-concept exploit code for any of the three flaws.
A critical NGINX vulnerability (CVE-2026-42945) disclosed last week is being exploited by attackers
Sources6
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.