NGINX patches five flaws, including a TLS client

Feeds.4Sysops •IT News • October 15, 2026

NGINX 1.30.6 and 1.31.7 fix five vulnerabilities, including memory bugs that could crash worker processes or possibly enable code execution. A separate TLS flaw could allow forged sessions to bypass client-certificate checks under a specific configuration. Upgrade promptly, especially if your server uses the affected directives. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

NGINX Patches Multiple Vulnerabilities, Including RCE Risks On October 14, 2026, NGINX released updates to address five vulnerabilities, including three memory bugs that could allow remote code execution (RCE) and a TLS flaw that may permit session forgery. The vulnerabilities, tracked as CVE-2026-97205, CVE-2026-93479, and CVE-2026-15176, have been rated as High or by F5, the company behind NGINX. These flaws require specific configurations to exploit and do not appear to have been in the wild. The affected versions include NGINX Plus and NGINX Open Source. NGINX has advised users to update to versions 1.30.6 or 1.31.7 to mitigate these risks. The vulnerabilities were disclosed in advisories published by F5 on the same day as the patches. No active exploitation has been reported, and none of the vulnerabilities were listed in CISA's Known Exploited Vulnerabilities catalog as of October 15. 8 sources 58

Extracted Entities

Tools (1)

Nginx