On October 14, NGINX released versions 1.30.6 and 1.31.7 to address five security vulnerabilities, one of which has persisted since May 2005. These updates aim to mitigate risks including potential remote code execution and a TLS bug that could bypass client-certificate verification.
Details of the Vulnerabilities
Among the five flaws, three are memory-related issues that could cause a worker process to crash or potentially allow attackers to execute arbitrary code. Each of these vulnerabilities requires specific configurations to be exploited. Another flaw allows TLS session forgery, which could slip past client-certificate checks, though it is considered a non-deterministic risk, according to F5, the company behind NGINX. The final vulnerability involves HTTP/3 clients inserting extra bytes into requests that NGINX forwards to a backend server.
These issues were not listed in the CISA’s Known Exploited Vulnerabilities catalog as of October 15, and neither NGINX nor F5 has reported any known attacks. NGINX has rated all five vulnerabilities with a medium severity, while F5 has assigned a critical score of 9.2 out of 10 for the three memory flaws, an 8.3 for the TLS flaw, and a 6.9 for the HTTP/3 issue based on CVSS v4.0.
Configurations and Exposure
Each vulnerability requires certain directives to be vulnerable, such as alias with rewrite, regex maps, AIO with SSI, shared TLS session cache, or HTTP/3. NGINX documentation advises using a shared session cache and request buffering, which are default settings for HTTP/3.
The TLS issue is linked to the automatic rotation of session ticket keys. Since version 1.23.2, NGINX generates and rotates these keys unless they are loaded from a file. A flaw in the rotation process left one key slot with uninitialized data, potentially enabling session forgery.
Addressing the Flaws
NGINX recommends upgrading to version 1.30.6 on the stable branch or 1.31.7 on the mainline to resolve these vulnerabilities. The stable release focuses exclusively on fixes, while older versions remain vulnerable unless patches are backported by distributions.
Users unable to upgrade immediately can refer to F5’s provided workarounds for each flaw. This involves avoiding specific configurations or applying temporary fixes until an upgrade is possible.
Looking Ahead
This update marks NGINX’s eighth security release in 2026, underscoring the importance of maintaining up-to-date software to protect against emerging vulnerabilities. F5 acknowledges several researchers, including Matt Suiche and Mateusz Gierblinski, for their contributions in identifying these flaws.
Alongside these updates, NGINX also released njs 1.0.2, which addresses medium-severity vulnerabilities in its JavaScript module, further enhancing the security posture of NGINX server environments.
