Historical article date: 2026-10-14 (disclosure and security release date). Sources checked and information supplemented through 2026-10-27.

Event and impact

NGINX released Stable 1.30.6 and Mainline 1.31.7 on 2026-10-14, fixing five core vulnerabilities: CVE-2026-15176, CVE-2026-93479, CVE-2026-97205, CVE-2026-95101 and CVE-2026-97629. They affect path mapping, variable evaluation, asynchronous file operations, HTTP/3 request bodies and TLS session tickets. Exposure depends on configuration; not every NGINX deployment is vulnerable to remote code execution.

Priority actions

  1. For upstream packages, meet the separate Stable 1.30.6 or Mainline 1.31.7 patch baseline. Mainline 1.31.8 was available at the later verification date. For distribution packages and NGINX Plus, verify the vendor’s branch and full package version.
  2. Audit combinations involving alias, rewrite, map, SSI/AIO, HTTP/3 and shared TLS session caches. Prioritize public endpoints and services using client certificate authentication.
  3. Validate configuration, then restart or roll out replacements for every old instance. An ordinary configuration reload does not prove that the live binary has been updated.

Verification and follow-up

Confirm that real endpoints use fixed packages or images, and test proxied uploads, request body limits, routing and client certificate authentication. WAF, ASLR and temporary configuration changes cannot replace patches. One distribution’s fix status cannot be assumed to apply to another.

This article is archived under the October 14 event date and includes later information. Read the full NGINX vulnerability and remediation guide for affected configurations, branch-specific fixes, patch mechanisms, temporary mitigations and official sources.