F5 NGINX (14 Oct): nginx 1.31.7 / 1.30.6 fix five data-plane flaws, three rated CVSS 8.1 (CVSS 4.0 9.2) by F5 — use-after-free with SSI + AIO, and heap overflows in alias/rewrite and map/regex configs that can crash workers or, with ASLR bypassed, run code

nginx.org released nginx 1.30.6 (stable) and 1.31.7 (mainline) on 14 October 2026 with fixes for five vulnerabilities, and F5 published matching advisories and CVE records the same day. The three most serious hit the NGINX data plane and are rated High 8.1 (CVSS 3.1) and Critical 9.2 (CVSS 4.0) by F5: CVE-2026-97205, a use-after-free in ngx_http_core_module when asynchronous file I/O (AIO) is on and a Server Side Includes page uses an include virtual command; CVE-2026-93479, a heap buffer overflow when map regex capture variables are evaluated in a root directive or access-log format before the map's own variable; and CVE-2026-15176, a heap buffer overflow when a location combines alias with rewrite and a set or return that references $request_filename (or $request_filename appears in a log_format). A remote unauthenticated request can crash and restart workers; F5 says code execution is possible only if ASLR is disabled or bypassed, and each bug needs a specific configuration. The same release also fixes CVE-2026-95101, HTTP/3 request body injection (F5 CVSS 5.3 / 6.9), and CVE-2026-97629, session forgery when TLS session ticket keys are rotated (6.5 / 8.3). nginx.org itself grades all five medium. NGINX Plus 37.x, NGINX Instance Manager, F5 WAF for NGINX, NGINX Gateway Fabric and some NGINX Ingress Controller releases are also affected; Plus R35 and R36 get no fix. No exploitation has been reported. Separate from the October nginx-ui card on this desk (a different project).

Product

F5 NGINX Open Source and NGINX Plus (plus NGINX Instance Manager, F5 WAF for NGINX, NGINX Gateway Fabric, NGINX Ingress Controller)

Versions

NGINX Open Source: CVE-2026-97205 and CVE-2026-15176 affect 1.31.0–1.31.6 and the 1.30.x and older lines up to 1.30.5 (CVE-2026-15176 back to 0.1.29); CVE-2026-93479 affects 1.31.2–1.31.6 and 1.30.0–1.30.5. Fixed: 1.31.7 (mainline), 1.30.6 (stable). NGINX Plus: 37.0.0–37.0.4 and 37.1.0 affected, fixed in 37.0.5.1 / 37.1.0.1 (F5's CVE-2026-95101 record lists 37.0.7.1 / 37.2.0.1 for the HTTP/3 fix); R35 and R36 affected with no fix. Fixed related builds per F5: NGINX Instance Manager 2.24.0, F5 WAF for NGINX 5.16.0 or 5.14.2, NGINX Gateway Fabric 2.8.0, NGINX Ingress Controller 5.7.0.

CVSS

8.1 (F5, CVSS 3.1 High) / 9.2 (F5, CVSS 4.0 Critical) for CVE-2026-97205, -93479 and -15176; CVE-2026-97629 6.5 / 8.3; CVE-2026-95101 5.3 / 6.9. nginx.org rates all five medium.

Exploited in Australia?

unknown

Patch to

Upgrade NGINX Open Source to 1.31.7 or 1.30.6, NGINX Plus to 37.0.5.1 or 37.1.0.1 (move R35/R36 to a supported branch), and the related F5 NGINX products to the fixed builds in the F5 K articles. If you cannot patch at once: for CVE-2026-97205 turn off either aio or SSI; review configs for alias + rewrite + $request_filename and for map regex captures used in root or log_format, and keep ASLR enabled.

Primary: nginx.org — nginx security advisories (CVE-2026-15176, -93479, -95101, -97629, -97205; not vulnerable 1.31.7+, 1.30.6+; 14 Oct 2026) · Vendor: F5 K000162608 (CVE-2026-97205); also K000162416 (CVE-2026-15176), K000162607 (CVE-2026-93479), K000162613 (CVE-2026-95101), K000162606 (CVE-2026-97629) · CVE: CVE-2026-97205, CVE-2026-93479, CVE-2026-15176, CVE-2026-95101, CVE-2026-97629 · Cybersecurity News — Multiple NGINX flaws let remote attackers crash servers and execute malicious code (14 Oct 2026); CVE records at cve.org

vulnerabilities network