NGINX raunin: haddasawa, gyarawa da tabbatarwa samarwa Saukewa:

Kwanan labari na tarihi: 2026-10-14 (bayani da kwanan wata sakin tsaro). Abubuwan da aka bincika da ƙarin bayani ta hanyar 2026-10-27. Saukewa:

An adana wannan labarin ta ranar taron; sigar da sabuntawar sakin da aka fitar bayan Oktoba 14 an haɗa su a ƙasa. Saukewa: Masu sauraro: NGINX Open Source / NGINX Plus gidan yanar gizo da kuma jujjuya aikin wakili da ma’aikatan kulawa, ma’aikatan mayar da martani na tsaro, masu kula da rarrabawa, da injiniyoyi waɗanda suka tattara NGINX da kansu kuma suna kula da samfuran ɓangare na uku. Saukewa:

Wannan labarin yana mai da hankali kan manyan lahani na NGINX guda biyar waɗanda aka bayyana kuma an daidaita su sosai a kan Oktoba 14, 2026, sannan kuma ya waiwaya baya ga amincin ƙwaƙwalwar ajiyar wakilin da neman raunin mutunci daga Mayu zuwa Satumba 2026. Abubuwan da ke ciki sun haɗa da yanayin haifar da yanayi, matakin matakin-code, abubuwan da ke haifar da fa’idar aiki, gajeriyar aiwatar da aikin watsa labarai, gajeriyar aiwatar da aikin aiki, gajeriyar aiwatar da aikin watsa labarai, gajeriyar aiwatar da ayyukan aiki, gajeriyar aiwatar da aiki, gajeriyar aiwatar da aikin. baya zuwa tsofaffin rassan da tabbatar da samarwa. Nassoshi irin su S1 hanyar haɗin kai zuwa shafi na tushen. Ana amfani da jeri na misali kawai don nuna ra’ayoyin turawa da duba, kuma yakamata a tabbatar da su bisa ainihin sigar, gadon daidaitawa, dogaro, da ƙarfin kasuwanci kafin aiwatarwa. Saukewa:

TL; DR: Ayyukan fifiko Saukewa:

1. Ba da fifikon haɓaka tsaro. Domin nginx.org Buɗe Fakitin Tushen, sabunta Stable 1.30 reshe zuwa akalla 1.30.6 da kuma Mainline 1.31 reshe zuwa akalla 1.31.7. A ranar tabbatarwa, 1.31.8 shine na baya-bayan nan Mainline saki. Waɗannan ginshiƙi ne na reshe daban; kar a kwatanta lambobin su a fadin rassan. S1 S2
2. Tabbatar da shigarwar rarraba ta cikakken sigar fakitin. Ubuntu 22.04 / 24.04 / 26.04 / 26.10 suna da tashoshin baya na dillali; Debian 13 (trixie) yana buƙatar aƙalla 1.26.3-3+deb13u10. A tabbaci, Debian 12 (bookworm) kunshin 1.22.1-9+deb12u10 har yanzu yana da alamar abin ya shafa. Duba kowane CVE; Shawarar Debian 13 ba ta tabbatar da cewa an gyara Debian 12 ba. S13S14S15 Saukewa:
3. Bincika abubuwan haɗin kai guda biyar: alias + rewrite + $request_filename , map + regex + kimantawa mai canzawa, aio + ssi + include virtual , HTTP/3 tare da proxy_request_buffering on , kuma ssl_session_cache shared:... tare da atomatik TLS Juyawa maɓallin tikitin zama. Kasancewar umarni kaɗai ba ya tabbatar da amfani; tantance hanyar buƙatu da iyakar daidaitawa. S1 S3 S4
4. Sauya duk tsoffin matakai da kwantena. Gudun nginx -t, sa’an nan kuma sake kunna sabis ɗin ko aiwatar da babban aiki na birgima. Tabbatar da cewa tsoffin hanyoyin master/worker sun fita; nginx -s reload kadai baya tabbatar da cewa binary mai gudana ya canza. Saukewa:
5. Tabbatar da ainihin wuraren ƙarewa: HTTP/1.1, HTTP/2, HTTP/3 idan an kunna, abubuwan da aka haɗa da API gawawwakin buƙatun mTLS takaddun shaida, SSI shafukan yanar gizo. Yi rikodin tabbatar da fakitin, sigar, narkar da hoto, tafiyar matakai da sakamako ga kowane ƙarshen ƙarshen. Saukewa:
6. Idan haɓakawa nan take ba zai yiwu ba, cire abubuwan da suka dace: kashe mara amfani SSI / AIO ko HTTP/3 , bita mai rauni alias / rewrite / map m nassoshi, da kuma tantance wucin gadi ssl_session_tickets off; don abin ya shafa mTLS ayyuka. WAF , ASLR , Iyakoki na ƙididdigewa da canje-canjen sanyi suna rufe wasu yanayi kawai kuma ba za su iya maye gurbin faci na hukuma ba. S3 S4 S8 S12

1. Bayanin Rauni da Hukunce-hukuncen Hatsari

NGINX ya fito da 1.30.6 (Stable) da 1.31.7 (Mainline) a ranar 14 ga Oktoba, 2026, yana gyara batutuwan tsaro guda biyar. Uku sun haɗa da tarin tudu ko amfani-bayan kyauta kuma sun karɓi F5 CVSS v4.0 maki na 9.2 / Critical. Sauran biyun sun shafi amincin buƙatun HTTP/3 da amincin takardar shaidar abokin ciniki na TLS. S1S2S3 Saukewa:

Bambance tsarin ƙididdigewa: nginx.org ya lissafa dukkan batutuwa biyar a matsayin medium, yayin da F5 CVSS v4.0 da wasu hukumomin tsaro na ƙasa ke rarraba batutuwan ƙwaƙwalwar ajiya guda uku a matsayin Mahimmanci. Wannan baya nufin cewa duka biyar suna ba da izinin aiwatar da lambar nesa mara sharadi. Daidaitawa, isa ga zirga-zirga da yanayi a waje da abin da maharin ke sarrafa shi. Lalacewar ƙwaƙwalwar ajiya da amintaccen RCE matakan shaida daban-daban. S1S3S4 Saukewa:

CVE Saukewa:	Matsalolin fasaha da yanayi na jawo hankula Saukewa:	core tasiri Saukewa:	Kima da zubarwa Saukewa:
CVE-2026-15176	alias taswirar hanya + rewrite canza URI + kimantawa $request_filename Saukewa:	Matsakaicin tulin tudu, hadarin Worker; m RCE karkashin wasu sharudda Saukewa:	F5 CVSS v4.0 9.2; ba da fifiko wajen warware matsalar Saukewa:
CVE-2026-93479	HTTP/Stream kimanta rubutun, musamman map regex kama da root directory, log m giciye-reference Saukewa:	Rubutun da aka tanada an sake rubuta shi kuma tudun ya cika; m RCE karkashin wasu sharudda Saukewa:	F5 CVSS v4.0 9.2; haɗarin koma baya ne bayan gyare-gyaren baya Saukewa:
CVE-2026-97205	SSI kama-da-wane ya haɗa da kuma AIO/aikin aiki tare; gagarumin aiki Count ambaliya Saukewa:	Amfani-Bayan-Kyauta, ɓarna Worker, lalata ƙwaƙwalwar ajiya; Saukewa: RCE Saukewa:	F5 CVSS v4.0 9.2; yana buƙatar saitin da ba na asali ba Saukewa:
CVE-2026-95101	HTTP/3 Firam ɗin da ba a sani ba yana rarrabuwar kawuna, an kunna buffer na wakili na jiki Saukewa:	Ba daidai ba shigar da ba DATA bytes cikin jikin buƙatun sama, mai yiyuwa ketare iyakar girman jikin buƙatu Saukewa:	Wannan raunin yana shafar amincin buƙata. Ita kanta ba ta ba da aikin aiwatar da lambar nesa ba (RCE).
CVE-2026-97629	Cache Zama na TLS Raba, jujjuyawar maɓalli ta atomatik da madubi na Worker Saukewa:	Jarun Tikitin Zama; Tabbacin takardar shaidar abokin ciniki na iya faruwa don sabis ɗin mTLS da abin ya shafa Saukewa:	Ana buƙatar kulawa ta musamman ga tasirin kasuwanci na nau’in tabbatar da takaddun shaida API Saukewa:

Makin CVSS na sama an ba da shi ta F5 ta amfani da v4.0; lahani iri ɗaya na iya nuna tsanani daban-daban a cikin CVSS 3.1, nginx.org nasa maki da ƙimar tsananin rarraba. S1S3S4 Saukewa:

1.1 Ba da fifikon fidda kai maimakon makin CVE kadai Saukewa:

Siffan turawa Saukewa:	Mabuɗin bincike Saukewa:	Shawarwari fifiko na zubarwa Saukewa:
Wakili na baya na cibiyar sadarwar jama’a, gami da na musamman rewrite, alias, da hadaddun map Saukewa:	CVE-2026-15176, CVE-2026-93479 da sake rubutawa/taswirar rauni daga Mayu zuwa Yuli Saukewa:	P0: Duba kuma sabunta nan da nan Saukewa:
API / Gudanar da jirgin sama ta amfani da takardar shaidar abokin ciniki azaman kawai ko babban tabbacin shiga Saukewa:	Tikitin Zama da daidaitawar ma’ajiyar CVE-2026-97629 Saukewa:	P0: Nan da nan tabbatar da iyakar tabbatarwa da sabuntawa Saukewa:
Samar da ɗorawa HTTP/3 na waje, canjin yanayi, ajin ciniki API Saukewa:	CVE-2026-95101, musamman jikin buƙatun yana da kusanci zuwa ƙarshen baya Saukewa:	P0/P1: Tsara bisa mahimmancin kasuwanci Saukewa:
SSI Mai ƙarfi shafi ko fayil I/O mara daidaituwa	CVE-2026-97205	P1: Tabbatar da yanayin haɗuwa da gyara da wuri-wuri Saukewa:
Sai kawai a tsaye shafuka + HTTP/1.1/2 wakili mai juyawa Saukewa:	Har yanzu ana buƙatar tantance saiti da sigar, amma wasu sharuɗɗan CVE na iya ɓacewa Saukewa:	P1: Haɗe a cikin taga haɓaka tsaro na gaggawa Saukewa:
Yi amfani da Kubernetes Community ingress-nginx mai ritaya Saukewa:	Aikin yana dakatar da tabbatar da tsaro, kuma haɗarin da ke tattare da shi bai iyakance ga waɗannan CVEs guda biyar ba Saukewa:	Yi tsarin ƙaura mai sarrafawa ɗaya Saukewa:

P0/P1 shine aiki da shawarwarin zubar da kaya da aka bayar a cikin wannan labarin don fallasa cibiyar sadarwar jama’a da ƙwarewar takaddun shaida. Ba rarrabuwar kai ba ce ta CVSS, kuma bai kamata ta maye gurbin kadara ta cikin gida da canza ƙimar haɗarin ba. Saukewa:

1.2 Tasirin iyaka da izinin kai hari Saukewa:

Babban raunin da ke cikin wannan rukunin suna cikin jirgin sama na NGINX: wurin shiga harin shine haɗin abokin ciniki da buƙata, kuma ainihin tasirin yana faruwa a cikin tsarin Worker. Idan an cika sharuɗɗan amfani don ɓarnawar ƙwaƙwalwar ajiya, gabaɗaya izinin aiwatar da lambar yana iyakance ta mai amfani da ke gudana, ƙuntataccen kwantena, damar Linux, hawa da izinin hanyar sadarwa na Worker; yuwuwar RCE baya nuna gata ta root ta atomatik ko sasantawa. Saukewa: S4 Saukewa:

Amma ko da tsarin ba shi da gata, yana iya har yanzu yana da damar yin amfani da takaddun shaida, fayilolin da za a iya karantawa waɗanda ke ɗauke da maɓallai na sirri, alamun sabis na sama, fayilolin wucin gadi, API na ciki, da hanyoyin sadarwa masu iya isa. Don mTLS, keɓancewar tantancewa kanta na iya zama babban sakamakon kasuwanci, kuma ba lallai ba ne sai an haɗa shi da aiwatar da lambar. Saukewa:

2. Dalilin bincike Saukewa:

2.1 Fahimtar iyakoki guda uku masu saurin kuskure a cikin NGINX Saukewa:

NGINX worker tsari ne mai tsayi mai tsayi, tsari wanda ke gudana wanda ke kula da matsayin buƙatu, ayyukan da ba a daidaita su ba da ma’anar ladabi. Wannan raunin ya ƙunshi ƙuntatawa a matakan injiniya guda uku: Saukewa:

1. ƙima mai canzawa da girman ƙwaƙwalwar ajiya dole ne su kasance daidai: rewrite Bayan canza buƙatun URI, taswirar hanyar dole ne ta kasance daidai da location mai tasiri a halin yanzu; lokacin da mai fassarar rubutun ke ƙididdige tsayin canji, filin rubutu dole ne ya rufe ainihin fitarwa da wuraren da aka tanada. Saukewa:
2. Ayyukan asynchronous dole ne su tsawaita yanayin rayuwar ƙwaƙwalwar da ake buƙata: Lokacin da akwai karatun fayil da rubutu da ba a gama ba, jiran cache ko ayyukan zare, ba za a iya fitar da wurin ajiyar ajiyar buƙatun da ya dace a gaba ba. Saukewa:
3. Matsayin yarjejeniya da matsayin tsaro ba za a iya haɗawa ko tsallakewa ba: HTTP/3 Tsawon tsallen firam da ba a san shi ba ba za a iya ɗaukar shi azaman DATA na buƙatar tsawon jiki ba; TLS Duk ramummuka masu shiga cikin tabbatar da sa hannu dole ne a fara aiki da su daidai yayin jujjuya tikitin zama. Saukewa:

Abubuwan da ke biyowa sun dogara ne akan NGINX gyare-gyare na sama da sanarwar mai siyarwa don bayyana tsarin gazawar da za a iya haifarwa; guntun misalin shine don bincike, ba cikakkiyar lambar da za a iya amfani da ita kai tsaye don gyara yanayin samarwa ba. S5 S6 S7 S8 S9

2.2 CVE-2026-15176: Taswirar hanyar tsakanin alias da sake rubutawa URI bata aiki. Saukewa:

A cikin NGINX, location da suka dace da alias sun ƙayyade hanyar fayil; rewrite na iya canza buƙatun na yanzu URI. Bayan sake rubutawa, zato da ainihin taswirar location ke amfani da ita na iya daina riƙewa.

Hanyar sarrafa abin da abin ya shafa bai bincika sosai ba ko an sake rubuta buƙatar lokacin duba matsayin alias a cikin ngx_http_map_uri_to_path(). Lokacin da saitin ya ci gaba da kimanta $request_filename bayan sake rubutawa, ana iya gina hanyar tare da zato waɗanda ba su dace da yanayin URI na yanzu ba, a ƙarshe yana haifar da rubutattun waje zuwa ƙwaƙwalwar ajiya. Saukewa: S5 Saukewa:

Haɗuwa na yau da kullun (an yi amfani da shi azaman misali kawai don tantancewa, ba a ba da shawarar turawa ba): Saukewa:

# 仅用于识别风险模式：不是修复配置
location /foo/ {
    alias /srv/alias-root/;
    rewrite ^/foo/.*$ /new-path;
    return 200 $request_filename;
}

Hadarin bai iyakance ga return ba: set, if, add_header, log_format, da sauransu kuma suna buƙatar tantancewa idan an kunna kimar $request_filename a cikin tsari iri ɗaya. return a cikin misali kawai yana sa wannan hanyar jihar ta zama mai sauƙin gani, ba za a iya amfani da ita don ganin cewa duk saitunan samarwa za su haifar da ambaliya ba. Saukewa: S5S10 Saukewa:

Sakamakon harin: Gina buƙata na iya haifar da Worker don sake farawa ko katse sabis; A ƙarƙashin sharuɗɗa irin su ASLR ana rufewa ko ana iya wucewa, akwai yuwuwar RCE. Jigon facin na sama shine ƙin kammala sake rubuta taswirar hanyar URI a cikin mahallin alias wanda ba shi da inganci, maimakon kawai faɗaɗa wani taswira. Saukewa: S5S10 Saukewa:

2.3 CVE-2026-93479: Rashin daidaitawa tsakanin “sararin da aka keɓe” da tsayin madaidaicin gaske a cikin ƙimar rubutun Saukewa:

Hanyoyin HTTP da Stream na NGINX suna da masu kimanta rubutun da ke haɗa kirtani na zahiri da ƙima mai ma’ana a cikin kirtan sakamako. Misalai na aikace-aikacen sun haɗa da hanyoyin HTTP daftarin aiki root, hanyoyin shiga log, da maganganu masu ma’ana a cikin Stream. Saukewa:

Wasu jeri na map + maganganu na yau da kullun suna ba da damar ƙididdige ƙima don karantawa ta wasu maganganu kafin a tantance madaidaicin sakamakon map. Haɗe da hanyar aiwatar da rubutun tare da tsayuwar da aka keɓe, tsohuwar aiwatarwa za ta ƙirga sararin samaniyar len a cikin ma’ajin da aka kimanta a gaba, ta yadda ƙididdige ƙididdiga na rubutu na gaba ba su yi daidai da iyakar buffer ba. A cikin takamaiman jerin ƙima mai canzawa, rubutun kirtani na gaba na iya sake rubuta wurin da aka keɓe, yana haifar da tulin tuli. Saukewa: S6 Saukewa:

abubuwan haɗin kai Saukewa:	Me yasa ya dace a kula da shi Saukewa:
regex in map Saukewa:	Ɗaukar ƙima mai canzawa na iya samun tsarin rayuwa mai zaman kansa da halin caching Saukewa:
Abubuwan da ba a san su ba kamar $1, $2, da sauransu. Saukewa:	Sauƙaƙan sake rubutawa ta wasu maganganu na yau da kullun ko maganganu, yana sa wahalar bin diddigin mallaka Saukewa:
Canje-canje a cikin root Saukewa:	Kisa rubutun da ajiyar ajiya lokacin da ake kunna ginin hanya Saukewa:
log_format/Hanyar log mai ƙarfi Saukewa:	Ana iya haifar da irin wannan nau’in kimantawa daga baya a cikin buƙatar Saukewa:
Kalmomin rubutun a cikin stream Saukewa:	Gyaran sama kuma yana gyara ngx_stream_script_run(). Ba za ku iya bitar tsarin HTTP kawai ba. Saukewa:

Muhimmin dangantakar koma baya: Lambar da ke da alaƙa da wannan raunin tana da alaƙa da canje-canjen da suka gabata waɗanda suka daidaita CVE-2026-42533. DSA na hukuma na Debian 13 ya bayyana a sarari cewa lambar da abin ya shafa an gabatar da ita a cikin kunshin trixie ta hanyar bayanan tsaro na baya. Saboda haka, “An shigar da faci na yuli map” ba yana nufin an rufe CVE-2026-93479 na Oktoba ba; ya kamata a duba cikakken sarkar gyaran tsaro. S6S14S17 Saukewa:

Haɗarin RCE a nan yana da alaƙa da yanayin kariyar ƙwaƙwalwar ajiya, kuma bai kamata a yi iƙirarin cewa map regex kaɗai za a iya amfani da shi ta hanyar maharan da ba a san su ba. Saukewa: S11 Saukewa:

2.4 CVE-2026-97205: AIO Ƙididdigar aikin da ba a gama ba yana haifar da Amfani-Bayan-Kyauta.

Wannan raunin ba shine kawai “kunna SSI ba kuma zaku sami UAF”. Makullin ya ta’allaka ne a cikin ƙididdige aikin asynchronous ta hanyar babban buƙata. Saukewa:

NGINX Yi amfani da r->main->blocked don bin diddigin aiki na asynchronous wanda ba a kammala ba, a cikin tsohon aiwatarwa yana da ƙidayar 8-bit; wasu hanyoyin ba su yi babban bincike ba kafin ƙara ƙidayar. Lokacin da wannan babban buƙatun ya tara ayyuka masu ban mamaki 256, ƙidayar ƙidayar na iya haɗawa daga 255 zuwa 0. Hanyoyin da za su biyo baya za su yi kuskuren yin imani cewa babu wani aiki na asynchronous da ke hana buƙatun daga sakin, don haka sakin buƙatun ƙwaƙwalwar ajiyar buƙatun wanda har yanzu aikin ke magana. Saukewa: S7 Saukewa:

Ana iya raba tsarin gazawar zuwa: Saukewa:

1. Tare da hanyar I/O/zaren da aka haɗa asynchronous, shafin SSI yana gabatar da buƙatu da yawa ko karanta ayyukan ta hanyar include virtual. Saukewa:
2. Fitattun ayyuka na wani babban buƙatun ana tara su ne har zuwa babban iyaka wanda filin ƙidayar ke wakilta. Saukewa:
3. Ƙididdigar 8-bit tana zagaye, ba daidai ba an bayyana shi azaman “babu ayyukan da ke jiran aiki”. Saukewa:
4. Ana fitar da wurin ajiyar ajiyar buƙatun, yayin da fayil ke karantawa, yana jiran cache, ko sake kiran ayyukan zaren har yanzu yana riƙe da ambatonsa. Saukewa:
5. Ci gaba da sake kiran asynchronous kammalawa yana samun damar ƙwaƙwalwar ajiyar da aka saki, wanda ya haifar da faɗuwar UAF, Worker ko yuwuwar lalacewar ƙwaƙwalwar ajiya. Saukewa:

Gyaran hukuma yana ƙara NGX_HTTP_MAX_BLOCKED 250 zuwa fayil ɗin buƙatun buƙatun, kuma yana ƙara ƙuntatawa ga tacewar fitarwa, karanta cache, da hanyar zaren sama; lokacin da aka kai bakin kofa, ana kammala ayyuka tare da hanyoyin aiki tare, kuma idan ba za a iya sarrafa su cikin aminci ba, za a ƙi ƙarin ƙarin ayyukan da ke jira. Saukewa: S7 Saukewa:

Hukuncin zartarwa: Dole ne a kimanta ko SSI, AIO, haɗa kama-da-wane, buƙatun da sauran ayyukan da ba su dace ba na iya faruwa a hade a cikin sarkar buƙata ɗaya. Waɗannan yawanci ba tsoho ba ne tsayayyen tsarin wakilcin wakili. aio off; ko ssi off; na iya cire takamaiman abubuwan jan hankali, amma dogaro da ayyukan kasuwanci yakamata a fara tabbatar da su. S4S7S25 Saukewa:

2.5 CVE-2026-95101: HTTP/3 da ba a sani ba firam ɗin ya rikice tare da matsayin jikin buƙatar DATA Saukewa:

Dole ne mai binciken firam ɗin HTTP/3 ya bambanta tsakanin firam ɗin DATA (waɗanda ake buƙatar wuce su zuwa sarrafa jikin buƙatun HTTP) da firam ɗin da ba a sani ba waɗanda yakamata a tsallake su. Hakanan dole ne a adana tsayin firam ɗin da ba a san su ba daidai lokacin da ake rarrabuwa a cikin maɓallan cibiyar sadarwa. Saukewa:

Tsohuwar aiwatar da ngx_http_v3_parse_data() ta yi amfani da filin st->length don adana “sauran adadin bytes da za a tsallake” lokacin da ake tsallake firam ɗin da ba a sani ba, yayin da tace jikin buƙatar ya fassara filin iri ɗaya da “sauran DATA tsayin kaya”. Idan firam ɗin da ba a san shi ba ya faru da yaɗa kiraye-kiraye da yawa, rukunin bytes na gaba bayan an katse binciken na iya yin kuskure a matsayin ɓangaren ɓangaren buƙatar. Saukewa: S8 Saukewa:

Hatsari iri biyu sun taso: Saukewa:

• buƙatun alluran jiki: Za a iya aikawa da kayan aikin da ba DATA ba wanda abokin ciniki ya ƙaddamar zuwa aikace-aikacen sama, yana canza bayanan da aka karɓa ta hanyar baya. Saukewa:
• Ƙimar iyaka girman: client_max_body_size da sauran ƙuntatawa. Abubuwan da aka sa ran sun fi mayar da hankali kan hanyar DATA, kuma abun cikin da ba daidai ba yana iya ƙetare tabbacin da ya dace. Saukewa:

Halin yanayi na jawo hankalin da jami’in ya kwatanta shine lokacin da ngx_http_v3_module ya karɓi buƙatun HTTP/3 kuma ya tura proxy_request_buffering on. Ana kunna buffer na wakili ta tsohuwa a cikin ngx_http_proxy_module. Don haka, ya kamata a fara bincikar wakili na baya wanda ke kunna HTTP/3. Bai dace a ɗauka cewa babu wani yanayin jawo kawai saboda ba a rubuta proxy_request_buffering on; a sarari ba. Saukewa: S8S18

Sakamakon kai tsaye na wannan raunin ya kasance ga amincin buƙatun baya da canjin iyaka na tsaro, wanda ba daidai yake ba na RCE wanda aka kammala kai tsaye a cikin ainihin NGINX. Ƙarshen tasirin kasuwanci ya dogara da yadda waɗannan bytes ɗin ke karkatar da su da kuma aminta da su. Saukewa: S24 Saukewa:

2.6 CVE-2026-97629: Juyar da tikitin TLS ya rasa ramin maɓalli na uku Saukewa:

A cikin saitunan da abin ya shafa, NGINX na iya samarwa ta atomatik da kuma juya TLS maɓallan Tikitin Zama ta hanyar ma’ajiyar ƙwaƙwalwar ajiya, ƙyale Worker da yawa don aiwatar da tikiti iri ɗaya. Saukewa:

Ma’anar daidaitawa da ta dace ta keɓance maɓalli 3 don kowane Worker, kuma sake kiran da aka ɓoye zai kuma ratsa waɗannan ramummuka; amma tsohon aiwatarwa kawai yana kwafi 2 key ramummuka daga ƙwaƙwalwar da aka raba kowane lokaci, wanda ya haifar da sunan maɓallin, maɓallin HMAC da AES na ramin na uku. Maɓalli na iya kasancewa ba a buɗe ba. Idan mai gano maɓalli na tikiti ya dace da wannan matsayi, ana iya amfani da kayan da ba a buɗe ba don tabbatar da sa hannu da ɓarnawa, don haka samar da hanyar ƙirƙira zaman TLS. Saukewa: S9 Saukewa:

Haɗin haɗaɗɗiyar haɗarurrukan turawa yawanci sune: Saukewa:

# 仅为排查触发条件所示：共享缓存本身不是恶意配置
ssl_session_cache shared:SSL:10m;
# 未显式配置 ssl_session_ticket_key 文件，使用自动轮换机制

Mafi munin sakamakon kasuwanci na wannan raunin shine cewa akan ayyukan da ke amfani da takaddun shaida na abokin ciniki (mTLS) a cikin ssl_verify_client on; da sauran hanyoyin, zaman dawo da jabun na iya ƙetare tabbatar da takardar shaidar abokin ciniki. Nasarar harin kuma yana cikin yanayin da ba za a iya sarrafawa ba; rukunin yanar gizon da kawai ke amfani da takardar shedar HTTPS ta gefen uwar garken ta al’ada kuma babu tabbacin shaidar abokin ciniki da bai kamata a ɓadda shi a matsayin “mai hari zai iya ketare duk shiga gidan yanar gizon ba.” Saukewa: S9S12 Saukewa:

Wannan a TLS Batun tantance matsayin zaman kuma bashi da alaƙa da ko uwar garken TLS keɓaɓɓen maɓalli ya fashe ko jama’a CA root takardar shaida ya shafi. S24

2.7 Yadda ake fahimtar DoS, RCE, keɓancewar tantancewa da sanannun fa’idodi Saukewa:

• DoS: Kuskuren ƙwaƙwalwar ajiya yana haifar da Worker don faɗuwa ko sake yi da yawa. Ko yana haifar da rashin samun gabaɗaya yana da alaƙa da matsa lamba na zirga-zirga, ikon sake farawa tsari, lokacin tabbatar da haɗin kai da babban samuwan gine-gine. Saukewa:
• yuwuwar RCE: Wasu sanarwar suna nuna cewa akwai yuwuwar aiwatar da lambar lokacin da aka rufe ko ketare ASLR. Wannan baya nufin an bayyana sarkar harin jama’a da za ta iya aiwatar da umarni a tsaye kuma a ko’ina cikin duniya. Saukewa: S4 Saukewa:
• Nemi allura / wucewar tantancewa: Yana iya canza yanayin kasuwanci mai kariya kai tsaye ko buƙatar abun ciki, kuma ba za a iya yin watsi da shi ba kawai saboda baya samun harsashi kai tsaye. Saukewa:
• ya gano yunƙurin kai hari: CVE-2026-42945 a watan Mayu 2026 yana da rahotannin ayyukan cin zarafi a cikin daji; bai kamata kai tsaye ga wannan gaskiyar tarihi ba don nufin cewa an yi nasarar cin nasarar duk CVEs guda biyar a cikin Oktoba a kan babban sikelin. Saukewa: S23 Saukewa:

3. Gyara sigar da zaɓin faci Saukewa:

3.1 NGINX Open Source tushen facin hukuma Saukewa:

reshe na sama Saukewa:	Sigar hukuma ta farko wacce ke rufe lahani biyar a cikin Oktoba Saukewa:	Shawarwari kamar na 2026-10-27 Saukewa:
Stable 1.30.x	1.30.6（2026-10-14）	Shigar da aƙalla 1.30.6, kuma ku biyo baya tare da sigogin tsaro na gaba. Saukewa:
Mainline 1.31.x	1.31.7（2026-10-14）	1.31.8（2026-10-21）
Reshen NGINX Open Source na baya Saukewa:	Ba za a iya yin hukunci ba kawai bisa “an yi amfani da tsoffin facin rashin lahani” Saukewa:	Ka yi ƙaura zuwa reshen da aka kiyaye da farko; in ba haka ba, ana buƙatar mai siyarwa ya ba da shaida ta hukuma ta goyan baya akan tushen CVE-by-CVE. Saukewa:

Waɗannan su ne ƙarshen sigar nginx.org lambar tushe/reshe na hukuma na sama, kuma bai kamata a yi amfani da shi don ƙaryata fakitin tsaro kai tsaye tare da gyare-gyaren da aka kawo ba ta hanyar mai siyar da rarrabawa. Ko da darajar 1.31.6 ta fi 1.30.6, har yanzu tana ƙasa da tushen facin reshen babban layi. Saukewa: S1S2

3.2 Tasirin tasirin sama na CVEs biyar Saukewa:

An jera jeri mai zuwa bisa ga ainihin rubutun nginx.org na bayanin tsaro kuma ana buƙatar fahimtar su tare da “reshen da ke gudana na yanzu” da “hanyar daidaitawa ta ainihi”: Saukewa:

CVE Saukewa:	Abubuwan da suka shafi alamun masu tasowa Saukewa:	Kafaffen sigar da aka yiwa lakabi da hukuma Saukewa:
CVE-2026-15176	0.1.29–1.31.6	1.30.6+ ko 1.31.7+, a cikin rassansu daban-daban. Saukewa:
CVE-2026-93479	1.30.0–1.30.5，1.31.2–1.31.6	Daidai da na sama Saukewa:
CVE-2026-97205	0.8.11–1.31.6	Daidai da na sama Saukewa:
CVE-2026-95101	1.25.0–1.31.6	Daidai da na sama Saukewa:
CVE-2026-97629	1.23.2–1.31.6	Daidai da na sama Saukewa:

CVE-2026-93479 yana da ƙayyadaddun iyakokin gabatarwa-version; Ba kowane tsohuwar sigar NGINX ke shafar wannan koma baya ba. Tsofaffin juzu’an da ke wajen waɗancan jeri na iya har yanzu rashin lafiyar map regex na baya CVE-2026-42533 zai iya shafar su. Saukewa: S1 Saukewa:

3.3 Ubuntu: wuraren rarrabawa (USN-8955-1) Saukewa:

Canonical USN-8955-1 Oktoba 26, 2026 yana ba da sabuntawar tsaro don ginin Ubuntu guda huɗu: S13 Saukewa:

Saukewa: Ubuntu Saukewa:	nginx da fakitin tushe iri ɗaya kafaffen sigar Saukewa:	Bayani Saukewa:
22.04 LTS	1.18.0-6ubuntu14.22	Mai siyarwa ce ta baya; lambar sigar da ke sama har yanzu tana nuna 1.18.0 Saukewa:
24.04 LTS	1.24.0-2ubuntu7.19	Daidai da na sama Saukewa:
26.04 LTS	1.28.3-2ubuntu1.12	Daidai da na sama Saukewa:
26.10	1.30.4-7ubuntu1.1	Daidai da na sama Saukewa:

Sanarwar ta ƙunshi daidaitattun sigogin fakiti masu kama da juna kamar nginx-core, nginx-extras, nginx-full, da nginx-light. Kar a zana ƙarshe game da ko za a gyara shi daga ɓangaren sama kawai wanda nginx -v ya nuna. Irin su Ubuntu 24.04 da 1.24.0-2ubuntu7.19 wannan mai siyar ya yi faci, amma 1.24.0 daga kowane tushe ba shi da aminci a zahiri. Saukewa:

Ubuntu a hukumance kuma a fili ya nuna hakan CVE-2026-95101 illa kawai Ubuntu 26.04 / 26.10 , kuma CVE-2026-97629 illa kawai Ubuntu 24.04 / 26.04 / 26.10. Anan Ubuntu Marufi na kansa da ikon aiki, waɗanda ba za a iya inganta su kai tsaye zuwa sauran rabawa ba. S13

3.4 Debian: Bambance-bambance tsakanin nau’ikan dole ne a bincika daban Saukewa:

Debian nasiha DSA-6575-1 (2026-10-21) ya rufe waɗannan CVEs guda biyar kuma yana gano ƙayyadaddun fakitin nginx don Debian 13 / trixie kamar: Saukewa:

1.26.3-3+deb13u10

Koyaya, har zuwa lokacin tabbatar da wannan rahoton, 1.22.1-9+deb12u10 na Debian 12 / bookworm har yanzu yana da alama a matsayin mai rauni ta Debian Tsaro Tracker. Saboda haka: Saukewa:

• Debian 13 Kawai sabunta kuma karba bisa ga DSA-6575-1. Saukewa:
• Debian 12 dole ne ya duba gyare-gyaren tsaro wanda mai binciken Tsaro na yanzu ko ELTS ya bayar ɗaya bayan ɗaya; kafin a tabbatar da gyara a cikin sanarwar, kar a bayyana cewa an daidaita dukkan abubuwa biyar bisa nasarar apt upgrade. Saukewa:
• Kunshin tushen Debian na iya ɗaukar saitin faci mai zaman kansa daga lambar sigar nginx.org. Don ginawa na al’ada, kuna buƙatar bincika cikakken saitin gyara lambar tushe, kuma ba za ku iya kwafin alƙawarin sama ɗaya kawai ba kuma kuyi la’akari da shi cikakke. Saukewa:

Bambancin da ke sama ya dogara ne akan bayanan bin diddigin DSA da CVE. S14S15S16 Saukewa:

3.5 NGINX Plus, njs da Mai Kula da Ingress Saukewa:

Kayayyaki/Kayayyakin Kayayyaki Saukewa:	Zaɓin Tsaro da Maɓallin Tabbatarwa Saukewa:
NGINX Plus (Sigar kasuwanci) Saukewa:	Da fatan za a koma zuwa sanarwar sanarwa da haɓaka umarni na reshen Plus wanda ya dace da F5. Sabuwar CR a lokacin tabbatarwa shine PLS.37.2.0.1, kuma ginin tsaro na LTS shine PLS.37.0.7.1; Ba za a iya maye gurbin sigar ƙari da abin da aka haɗa ta baya kai tsaye ta hanyar buɗe tushen 1.30/1.31. Saukewa: S19 Saukewa:
njs / ngx_http_js_module	2026-10-14 yana sakin njs 1.0.2 kuma yana gyara CVE-2026-101019 da CVE-2026-101025; idan kana amfani da njs, dole ne ka kuma duba dacewa da tsarin tare da NGINX. Saukewa: S20 Saukewa:
F5 NGINX Mai Kula da Ingress / Ƙofar Fabric Saukewa:	Babban NGINX yana da alaƙa amma sarkar rarraba software mai zaman kanta. Gyara raunin da ya dace tare da masu sarrafa su, hotuna da bayanin kula na saki. Ba za ku iya maye gurbin binary na NGINX kawai a cikin Pod ba. Saukewa:
Kubernetes Community kubernetes/ingress-nginx Saukewa:	An dakatar da aikin a cikin Maris 2026 kuma ba zai sake samar da sabon kulawar tsaro ba. Ya kamata ku yi shirin ƙaura zuwa mai sarrafawa ko Gateway API maimakon kuskuren lambar sakin sa don F5 NGINX Mai Kula da Ingress. Saukewa: S21 Saukewa:

3.6 Wanne Patch ya kamata ku zaɓa a zahiri? Saukewa:

Siffan turawa Saukewa:	Ayyukan da aka ba da shawarar Saukewa:	Tabbacin gyarawa Saukewa:
nginx.org fakitin DEB/RPM na hukuma Saukewa:	Haɓaka zuwa tsayayyen sigar reshe na sama Saukewa:	nginx -v/-V, tushen kunshin, sanarwar tsaro ta hukuma Saukewa:
Ubuntu/Debian ma’ajiyar hukuma Saukewa:	Sanya fakitin tsaro na mai siyarwa Saukewa:	Cikakken sigar fakiti + mai siyarwa USN/DSA + matsayin CVE Saukewa:
RHEL/Alma/Rocky/SUSE/Sauran rabawa Saukewa:	Haɓaka bisa ga takamaiman bayanan tsaro na rarrabawa da nau’ikan fakiti Saukewa:	Mai siyarwa CSAF/sanarwa, Ubuntu/Debian sigar ba za a iya amfani da ita ba. Saukewa:
Hotunan kwantena na hukuma ko na al’ada Saukewa:	Sake ginawa ko ja ingantaccen hoton gyara kuma musanya shi akan mirginawa Saukewa:	Narkar da hoto, gina SBOM, ID na hoton kwasfa/kwantena mai gudana Saukewa:
NGINX da kansa ya tattara, OpenResty, Tengine ko nau’ikan da aka fake da na’urori na ɓangare na uku Saukewa:	Ba da fifikon amfani da cikakken sigar tsaro na mai kula; aiwatar da facin baya da aka yi bita don bishiyar tushen manufa idan ya cancanta Saukewa:	Gyaran raunin rauni guda biyar, dacewa da ABI/module, naúrar da koma bayan kasuwanci Saukewa:

OpenResty da Tengine tsarin saki daban-daban ne; wannan tebur yana bayyana hanyar tabbatarwa kawai. Ba yana nufin cewa duk nau’ikansa suna shafar lokaci guda da daidaitaccen NGINX ba, kuma ba za a iya amfani da facin lambar da ke sama ba tare da wani sharadi ba. Saukewa:

4. Tsarin gyara na yau da kullun Saukewa:

4.1 Haɗin kai na ainihin lokutan karɓar zirga-zirgar waje Saukewa:

Haɗa don kowane shigarwa aƙalla: Saukewa:

• Sunan yanki, daidaita nauyin kaya/CDN/hanyar wakili na gefen, hanyar bayyanar rukunin yanar gizon asali da ka’idar cibiyar sadarwa da aka yi amfani da ita. Saukewa:
• Samfuran NGINX (Bude tushen, Ƙari, Ƙaddamarwa, da sauransu), cikakken sigar, tushen ma’ajiyar fakiti, narkar da hoto. Saukewa:
• nginx -V yana nuna ƙirar gine-gine da sigogi masu haɗawa; ko akwai njs, Lua, OpenResty, da na’urori masu ƙarfi na ɓangare na uku. Saukewa:
• Gaskiya mai gudana master/worker PID, Sabis na Sabis/Container/Pod, Replica da Worker Node. Saukewa:
• Haƙiƙanin daidaitawar http/stream, server, location, include. Saukewa:
• Ko don kunna HTTP/3, mTLS, SSI/AIO, hanyar log mai ƙarfi, hadaddun map da kama regex. Saukewa:

Kada a duba tsohuwar /etc/nginx/nginx.conf. Yanayin samarwa sau da yawa yana ɗaukar shafuka masu yawa, TLS da daidaitawar module ta hanyar include. Hakanan ana iya samun hanyoyin shigarwa na NGINX da yawa ko yadudduka na wakili masu yawa. Saukewa:

4.2 Duba sigar da bayanin haɗawa

# NGINX 版本及构建选项
nginx -v
nginx -V 2>&1

# Linux：查看实际运行的 NGINX 进程
ps -eo pid,ppid,user,comm,args | grep '[n]ginx'

# Debian / Ubuntu：查看完整已安装包版本、来源
apt-cache policy nginx
# 兼顾 nginx-core / nginx-full / nginx-extras 等实际已安装包
dpkg-query -W 'nginx*' 2>/dev/null

# RPM 系：以实际安装包及仓库公告为准
rpm -qa | grep '^nginx'

nginx -V ya ba da rahoton ginin binary da aka samo akan hanyar layin umarni; ba ya tabbatar da cewa worker mai gudana ya loda shi. nginx -v na iya ƙetare cikakkiyar maƙasudin fakitin rarraba, don haka duba mai sarrafa fakitin ko bayanan sarkar kayayyaki kuma. Saukewa:

4.3 Fitar da ingantaccen tsari kuma aiwatar da zagaye na farko na nunin tsaye Saukewa:

nginx -T zai gwada saitin kuma ya zubar da tsarin da aka haɗa. Fitowar na iya ƙunsar mahimman bayanai kamar takaddun shaida, hanyoyin maɓalli, sunayen baƙi na ciki, da sauransu. Ana ba da shawarar adana tashar sarrafawa tare da izini na root da izinin fayil na sirri, kuma kar a buga ainihin fayilolin zuwa odar aikin jama’a: Saukewa:

sudo sh -c 'umask 077; nginx -T > /root/nginx-effective.conf 2> /root/nginx-config-check.log'

sudo grep -nE \
  'alias|rewrite|map[[:space:]]|request_filename|aio[[:space:]]|ssi[[:space:]]|quic|http3|proxy_request_buffering|ssl_session_cache|ssl_session_ticket_key|ssl_session_tickets|ssl_verify_client|log_format|root[[:space:]]' \
  /root/nginx-effective.conf

Wannan shine kawai mai gano hanyar ɗan takara, ba ingantaccen kayan aikin tantancewa ta atomatik na CVE ba: Saukewa:

1. grep ba zai iya tantance ko masu canjin suna cikin location guda ɗaya ko sarkar ƙimar buƙatun iri ɗaya ba, kuma ba za ta iya yanke alaƙar daidaitawar gado ba. Saukewa:
2. proxy_request_buffering on, wasu cache da saitunan tikiti suna da ƙimar tsoho, kuma rashin rubuta umarnin da ya dace ba yana nufin haɗarin ya ɓace ba. Saukewa:
3. Saitunan da aka ƙirƙira ta hanyar wakilai na baya, CDN, motocin gefen akwati, ko masu sarrafawa na iya bambanta da fayilolin da aka bincika da hannu. Saukewa:
4. Halayen NGINX Plus da na’urori masu ƙarfi na iya buƙatar tabbatar da su ta amfani da kayan aikin gudanarwa na hukuma daban-daban. Saukewa:

4.4 Sanya gyara ta hanyar amintattun tashoshi Saukewa:

Debian/Ubuntu (Ma’ajiyar rarraba ta hukuma): Saukewa:

sudo apt-get update
apt-cache policy nginx

# 升级发行版仓库中已经安装的 NGINX 及相关包；
# 先确认 Candidate 属于修复版本，再执行升级。
sudo apt-get install --only-upgrade nginx

# 对实际安装的 nginx-core / nginx-full / nginx-extras 等包
# 确认它们的版本和依赖一同达到厂商修复要求。
dpkg-query -W 'nginx*' 2>/dev/null

Wannan saitin umarni ba zai iya samar da gyare-gyaren tsaro daga siraran iska da ba a samu ba tukuna. Musamman ga Debian 12, idan har yanzu fakitin da aka haɓaka ana ganin yana da rauni ta tsarin sa ido na tsaro, ƙarin gyaran dillali, keɓewa ko matakan ƙaura. S13S14S15 Saukewa:

Kunshin hukuma nginx.org: Saukewa:

# 先确认仓库来自 nginx.org、目标分支和候选版本
apt-cache policy nginx
# 经变更审批后再执行对应仓库的升级命令
sudo apt-get install --only-upgrade nginx

Idan ana amfani da haɗin kai, OpenResty, Tengine ko NGINX Plus, yi amfani da sigar gyara da goyan bayan mai kula da dacewa kuma kar a haɗa nginx.org, rarrabawa da fakitin ma’ajiyar ɓangare na uku. Ya kamata a adana binariyoyi/hotuna na asali, daidaitawa, sa hannu, da bayyana abubuwan da aka tura baya. Saukewa:

Kwantena/Kubernetes: sabunta hoton da ba zai iya canzawa, yin rikodin narkar da shi kuma musanya duk tsoffin kwafi tare da shirin aiwatarwa. kubectl rollout status kawai yana tabbatar da cewa mai sarrafa turawa ya gama; Hakanan tabbatar da narkar da hoto, shigar da bayanai da kuma kwafi marasa lafiya. Saukewa:

4.5 Tabbatar da daidaitawa kuma maye gurbin tsohon Worker Saukewa:

sudo nginx -t
# 按服务实际名称、主机高可用和变更窗口执行重启
sudo systemctl restart nginx
sudo systemctl status nginx --no-pager

# 核查真正存在的 master / worker
ps -eo pid,ppid,user,comm,args | grep '[n]ginx'

Kada ku bi nginx -s reload a matsayin hujja cewa sabon binary yana gudana: sake shigar da tsarin daidaitawa na yau da kullun bari tsohuwar master ta fara sabbin ma’aikata ba tare da maye gurbin wanda za’a iya aiwatarwa ba. NGINX yana goyan bayan ƙaƙƙarfan tsarin haɓaka binaryar kan layi, amma yana buƙatar ƙarin matakai da tabbaci. Ba tare da kafaffen hanya ba, yi amfani da babban babban canjin zirga-zirgar ababen hawa wanda zai biyo baya ta sake kunna sabis, ko fitar da kwantena masu sauyawa. Saukewa: S22 Saukewa:

Idan kuna sarrafa NGINX ta soket na systemd, rubutun shigarwar akwati, ko shigarwa da yawa, yakamata ku duba ainihin maƙasudin ƙaddamarwa da hanyar aiwatarwa maimakon ɗaukan kai tsaye cewa systemctl restart nginx ya ƙunshi duk lokuta. Saukewa:

4.6 Karɓa kuma yi koma bayan kasuwanci daga ainihin ƙofar waje Saukewa:

Ana ba da shawarar yin aƙalla: Saukewa:

• HTTPS na al’ada ne, hanyoyin da aka sake rubutawa, albarkatu a tsaye, da shafukan taswirar alias daidai ne. Saukewa:
• Shin rarrabawar map na yau da kullun, hanyar root mai canzawa, hanyar shiga shiga, SNI/takardar takaddun shaida, da Stream wakili daidai ne. Saukewa:
• Abubuwan lodawa na yau da kullun, abubuwan da aka yanke, buƙatun API da iyakoki na sama don HTTP/3 (idan an kunna) har yanzu kamar yadda aka zata.
• mTLS: Halatta buƙatun takaddun shaida yakamata suyi nasara; bacewar, ƙarewa, ko takaddun shaida mara izini yakamata a ƙi har yanzu, kuma sakewa/sake haɗin TLS bai kamata ya canza izini da gangan ba. Saukewa:
• Ko shafin SSI da shigar da fayil asynchronous al’ada ne; Kuskuren log ɗin yana nuna babu buƙatun da ba na al’ada ba don ambaton ƙwaƙwalwar ajiya ko maimaita haɗarin Worker. Saukewa:
• Bayan canjin zirga-zirga, tsarin tsohuwar sigar da tsohon hoton hoton yakamata sun fita. Saukewa:

Dole ne a gudanar da gwaji a nasa ko wurin da aka ba da izini. Gwajin hayaƙi na buƙatu na yau da kullun ba zai iya tabbatar da cewa an gyara raunin ƙwaƙwalwar ajiya ba; A ƙarshe, ƙayyadaddun sigar mai siyarwa, facin lambar tushe da gwajin lokacin aiki dole ne a karɓa tare don karɓa. Saukewa:

5. Matakan ragewa lokacin haɓakawa nan take ba zai yiwu ba Saukewa:

Wannan sashe zaɓi ne na rage haɗari, ba maye gurbin faci ba. Duk canje-canjen sanyi na wucin gadi yakamata a sami goyan baya, aiwatar da nginx -t, saki cikin batches, kuma da sauri a birgima baya idan ya cancanta. Saukewa: S3S4 Saukewa:

5.1 Sarrafa fifikon zirga-zirga dangane da fallasa waje Saukewa:

Ba da fifikon rage saman sabis ɗin da ba za a iya haɓakawa cikin lokaci ba: a saman gudanarwa da na ciki API Ƙara amintaccen ikon samun tushen tushe, keɓantawar hanyar sadarwa ko ta layi na ɗan lokaci; ƙara haɗin kai, buƙatar jiki da iyakokin ƙima zuwa manyan mashigai masu haɗari; tabbatar da cewa ingantaccen tushe yana faruwa a NGINX mai alaƙa da shigarwa kafin sarkar sarrafa buƙatun. Ya kamata a lura cewa yawancin raunin da kansu suna cikin NGINX A cikin jirgin sama na bayanai, Dokokin WAF na al’ada na iya ƙila ƙayyadaddun yanayin daidaitawar al’ada daidai. Saukewa:

5.2 alias / rewrite: kauce wa kimanta $request_filename bayan sake rubutawa Saukewa:

Ana ba da shawarar duba da daidaitawa: Saukewa:

• Gwada kada kuyi rewrite wanda zai canza URI a lokaci guda da location ta amfani da alias. Saukewa:
• Guji yin amfani da $request_filename lokacin da aka sake rubuta URI amma ba a kammala daidai matakin matsayi ba tukuna. Saukewa:
• Bincika nassoshi masu canzawa kaikaice a cikin return, set, if, add_header, tsarin shiga shiga, da haɗa fayiloli. Saukewa:
• Yi amfani da root/try_files/location mai zaman kansa lokacin da kasuwanci ya ba da izini, amma kawai yana canza alias zuwa root. Hakanan yana iya canza fassarar hanyar fayil ɗin, wanda dole ne a tabbatar da shi ɗaya bayan ɗaya. Saukewa:

Kar a kwafi “samfurin sake rubutawa” gama gari kai tsaye akan Intanet don sake rubuta tsarin da ke akwai. location prefixes daban-daban da sake rubuta maƙasudin suna haifar da rarrabuwar hanya tare da ma’anoni daban-daban. Saukewa: S5 Saukewa:

5.3 map/Regex: Rage cakuɗewar yanayin kama Saukewa:

Ana ba da shawarar ba da fifikon kama masu suna da iyakance iyawar su, maimakon barin abubuwan da ba a san su ba kamar $1 don sake amfani da su ta hanyoyi daban-daban na kimanta regex na tsawon lokaci. Misali: Saukewa:

# 演示具名捕获的结构，实际变量名和匹配表达式须按业务调整
map $host $tenant_root {
    default /srv/www/default;
    ~^(?<tenant>[a-z0-9-]+)\.example\.net$ /srv/www/$tenant;
}

Wannan snippet kawai yana nuna tsari mai sauƙi-zuwa-bincike na m ikon mallakar; baya nufin cewa an tabbatar da kawar da duk hanyoyin CVE-2026-93479 da kansa. Musamman, duba ko ana yin ishara da masu canjin kama kafin lokaci ta wasu root ko log_format, da kuma ko akwai volatile, hanyoyi masu ƙarfi, da sarƙoƙi masu dogaro da juna. F5/CERT yana ba da shawarar yin amfani da kama mai suna da iyakance iyakar amfani zuwa daidaitaccen daidaitawa na yau da kullun azaman taimako na ɗan gajeren lokaci. Saukewa: S3S6 Saukewa:

5.4 AIO + SSI: Kashe haɗin ayyukan da ba dole ba Saukewa:

Don sabobin/hanyoyin da basa buƙatar SSI ko fayil I/O mai asynchronous, yi amfani da:

# 在适当的 http/server/location 上下文中配置
ssi off;
aio off;

Daga mahangar yanayin da ke haifar da lahani, rufe ɗaya daga cikin biyun yakan isa ya cire takamaiman sarkar da aka bayyana; rufewa a lokaci guda yana aiki ne kawai ga al’amuran da kasuwancin bai dogara da wannan damar ba. Bincika include virtual, buƙatun buƙatun, cache, da halayyar tafkin zaren; lokacin da lodin wakili ya yi girma, rufe AIO na iya canza latency da aikin I/O. Saukewa: S7 Saukewa:

5.5 HTTP/3 Nemi allurar jiki: rufe ƙofar na ɗan lokaci idan ya cancanta Saukewa:

Disable the quic listener involving HTTP/3, cancel the Alt-Svc response header that announces HTTP/3, and check whether the edge layer/load balancer still sends QUIC requests directly to the unrepaired NGINX: Saukewa:

# 示意：保留 HTTPS/TCP；暂时移除此前的 QUIC/UDP listen
server {
    listen 443 ssl;  # 保留 HTTPS/TCP 入口
    # 对支持新版语法的构建，可在此使用 http2 on;
    # 删除原有的 listen 443 quic reuseport;
    # 删除原有的 add_header Alt-Svc ...;（仅限宣传 h3 的那项）
    # 其余证书、server_name、location 等配置保持不变
}

Abin da ke sama shine kawai bayanin bambancin canji, ba cikakken tsarin uwar garken da za’a iya kunnawa daban-daban ba. Tsarin saitin HTTP/2 yana da alaƙa da sigar NGINX; idan kana buƙatar riƙe HTTP/2, ya kamata ka yi amfani da http2 on; ko ingantaccen tsarin aiki na yanzu bisa ga sigar da ta dace, kuma duba tare da nginx -t. dole ne a haɗa shi da tsarin uwar garken da ake da shi kafin a tura shi, maimakon maye gurbin gabaɗayan sashe da wannan sashe. Hakanan yana duba bangon bangon UDP 443, wurin ƙarewar HTTP/3 da hanyar faɗuwar abokin ciniki na CDN/proxy na gaba. Saukewa:

Wani nau’in ragewa na ɗan gajeren lokaci shine amfani da proxy_request_buffering off; akan hanyar wakilcin da abin ya shafa, amma wannan zai canza halayen buƙatun buƙatun jiki na sama, rashin nasarar sake gwadawa, da wasu loda ayyukan aiki; kawai za a yi amfani da bayan isassun gwaji da tabbatarwa cewa umarnin ya shafi hanyar wakili na HTTP/3 da abin ya shafa. Saukewa: S8S18 Saukewa:

5.6 TLS Tikitin Zama: Kariyar fifiko mTLS Iyakar Tabbatarwa Saukewa:

Idan haɓakawa ba zai yiwu ba kuma misalan ya dogara da cache ɗin da aka raba + jujjuyawar maɓallin tikitin atomatik, kimanta: Saukewa:

# 在 nginx http/server 适当作用域进行配置
ssl_session_tickets off;

Wannan na iya kashe tsarin tikitin Zama na TLS, ta yadda za a cire hanyar jabun tikitin da aka bayyana a cikin wannan raunin; duk da haka, yana iya shafar aikin dawowar zaman. Ba za ku iya kawai kashe mTLS tabbacin takardar shaidar abokin ciniki don “guje wa lahani”, saboda hakan zai share ainihin iyakar tabbatarwa kai tsaye. Saukewa: S9S12 Saukewa:

Fayilolin ssl_session_ticket_key ƙwararru kuma za a iya amfani da su ta hanyar ƙwararrun hanyoyin gudanarwa na TLS don kewaya yanayin da aka samar ta atomatik, amma maɓalli mai mahimmanci, cikakken rarraba kumburi, juyawa, da tsofaffin tikitin rayuwa duk suna buƙatar a duba su a hankali. Ba a ba da shawarar yin hardcode maɓalli na dogon lokaci da za a sake amfani da shi a cikin tsarin gidan yanar gizo na yau da kullun ko rubutun don gaggawa na wucin gadi. Muhimman ayyuka masu amfani da mTLS yakamata kuma a kula dasu don halayen dawowar zama na TLS da ƙin buƙatun ba tare da ingantacciyar takardar shaidar abokin ciniki ba. Saukewa: S12 Saukewa:

5.7 Matsayin tsarin aiki da kariya ta iyaka Saukewa:

# Linux：常见值 2 表示进程地址空间随机化处于完整启用状态
sysctl kernel.randomize_va_space

ASLR, ma’aikatan da ba root ba, tsarin fayil ɗin ganga mai karantawa kawai, ƙarancin izinin fayil da keɓewar hanyar sadarwa na iya rage tasirin yuwuwar RCE. ASLR baya gyara tarin tudu ko UAF kuma ba zai iya ba da tabbacin cewa ma’aikata ba za su yi karo ba. WAF, iyakoki na ƙididdigewa da buƙatar iyakokin girman jiki ba su gyara aikin aiki tare da maɓallin tikitin TLS. Saukewa: S4 Saukewa:

5.8 Rashin fahimta gama gari: Waɗannan ayyukan ba su wadatar don kammala gyara ba Saukewa:

Ayyukan gama gari Saukewa:	Me yasa bai isa ba? Saukewa:
“nginx -v yayi kama da sabo” Saukewa:	Ba a duba reshen da ke cikinsa, cikakken sigar fakitin da aka dawo da shi da kuma tsarin kan layi. Saukewa:
“Daya daga cikin intranets ne kawai aka inganta” Saukewa:	Tsohuwar Worker/tsohuwar ganga/tsohuwar misalin asalin CDN har yanzu yana karɓar buƙatun Saukewa:
“Shafin ba ya amfani da alamun PHP/dynamic”	Lalacewar yana faruwa a cikin ainihin hanyar NGINX ko ƙaddamar da yarjejeniya kuma baya dogara ga aiwatar da PHP. Saukewa:
“Buɗe WAF/Cloudflare ya isa” Saukewa:	Ba za a iya tabbatar da WAF don toshe duk NGINX na’urorin da suka dogara da ƙayyadaddun ƙayyadaddun ƙwaƙwalwar ajiya ko kuskuren dawowar TLS Saukewa:
“An riga an buɗe ASLR” Saukewa:	Kawai amfani da damar rage wahala; DoS tare da allurar buƙatu har yanzu yana yiwuwa Saukewa:
“HTTP/3 ba a fallasa zuwa cibiyar sadarwar jama’a, don haka babu buƙatar haɓaka kwata-kwata” Saukewa:	Sauran CVEs guda huɗu har yanzu suna buƙatar ƙima mai zaman kansa; kuma ana iya samun alaƙa kai tsaye zuwa tushen ɓoye Saukewa:
“An gyara raunin map na Yuli” Saukewa:	Oktoba CVE-2026-93479 ya ƙunshi batutuwan da suka biyo baya na kimanta rubutun rubutu Saukewa:
“Kashe caching yana magance duk matsaloli” Saukewa:	Kawai yana rinjayar wasu cache TLS ko AIO yanayin yanayi, kuma baya rufe laƙabi, rubutun, HTTP/3 Saukewa:

6. Ra’ayoyin aiwatar da Patch na hukuma da wuraren bita Saukewa:

Wannan sashin yana biye da Oktoba 2026 na sama NGINX gyarawa. snippets suna kwatanta sauye-sauye na wakilci don bitar faci; ba su cika ba, gyare-gyare masu zaman kansu. Don ginawa na al’ada, bitar cikakkun abubuwan da aka yi, lambar kewaye da gwaje-gwaje, kuma zaɓi cikakken sakin tallafi. S5 S6 S7 S8 S9

6.1 CVE-2026-15176: URI an sake rubutawa don haɗawa alias yanayin ƙi taswirar hanya Saukewa:

ngx_http_map_uri_to_path() da aka sabunta a cikin src/http/ngx_http_core_module.c: Saukewa:

- if (alias && !r->valid_location) {
+ if (alias && (!r->valid_location || r->uri_changed)) {

mayar da hankali kan bita: Hanyar tsarin fayil ba za a iya ci gaba da ƙididdige shi ba lokacin da URI ya canza amma madaidaicin fassarar wurin alias ba abin dogaro bane. Wannan haɓakawa ne ga ƙaƙƙarfan ƙaƙƙarfan jaha. Ba abu mai sauƙi ba ne ko buƙatar URI ta ƙunshi haruffan da ba bisa doka ba. Saukewa: S5 Saukewa:

6.2 CVE-2026-93479: Daidaita rarrabe tsakanin tsayin bayanan fitarwa da tsayin da aka tanada Saukewa:

Abubuwan da ke sama suna yin sabuntawa src/http/ngx_http_script.c da src/stream/ngx_stream_script.c a lokaci guda. Za a iya taƙaita ainihin niyya kamar: Saukewa:

- n = len;
+ n = 0;
  /* ...计算实际脚本输出长度... */
- value->len = n;
- value->data = ngx_pnalloc(pool, n);
+ value->len = n + len;
+ value->data = ngx_pnalloc(pool, n + len);

Anan, pool sunan siga ne na misali: ainihin kalmomin HTTP da Stream sun bambanta. Canjin yana ƙididdige tsawon fitowar rubutun da farko, sannan yana ƙara tsayin da aka keɓe zuwa rabon ƙarshe don kada fitarwa ta sake rubuta keɓaɓɓen sarari. Saukewa: S6 Saukewa:

Lokacin dubawa da mayar da baya, madaidaicin mai kimanta HTTP/Stream dole ne a rufe shi; duba kawai fayil ɗin daidaitawa na map ba zai iya tabbatar da cewa an gyara lahanin ba. Saukewa:

6.3 CVE-2026-97205: Sanya ƙofa mai aminci don ƙidaya asynchronous aiki 8-bit Saukewa:

An ƙara haɓakawa a src/http/ngx_http_request.h: Saukewa:

#define NGX_HTTP_MAX_BLOCKED 250

Kuma ƙara irin wannan shigarwar zuwa karatun fayil ɗin asynchronous, jiran cache, tacewa fitarwa da aikin zaren: Saukewa:

if (r->main->blocked >= NGX_HTTP_MAX_BLOCKED) {
    /* 使用同步路径，或者拒绝新的异步操作 */
}

mayar da hankali kan bita: Duk ainihin hanyoyin lambar da za su ƙara r->main->blocked dole ne a rufe su. Ba za ku iya rubuta madaidaicin kofa kawai a cikin fayil ɗin taken ba. Backport kuma yana buƙatar bincika cikakken daidaitawa na koma baya na aiki tare, dawo da kira asynchronous da dawowar kuskure don tabbatar da cewa ba za a haifar da ƙulli ko zubewar tunani ta hanyar kin ayyuka kai tsaye ba. Saukewa: S7 Saukewa:

6.4 CVE-2026-95101: Rike matsayin skip daban don firam ɗin da ba a sani ba Saukewa:

Matsakaicin sama yana ƙara filin skip a cikin tsarin sifa na HTTP/3 kuma yana aiwatar da rabuwar matsayi: Saukewa:

if (st->type != NGX_HTTP_V3_FRAME_DATA && st->length > 0) {
    st->skip = st->length;
    st->length = 0;
    st->state = sw_skip;
}
/* ... */
rc = ngx_http_v3_parse_skip(b, &st->skip);

Makullin ba shine “musaki firam ɗin HTTP/3 da ba a san su ba”, amma don tabbatar da cewa a duk faɗin karantawa da yawa, ƙididdigar byte da aka tsallake da tsayin nauyin kaya na DATA koyaushe ana sarrafa su ta jihohi masu zaman kansu. Ya kamata sake dubawa su mayar da hankali kan sharar giciye da ba a san su ba, da kuma daidaito na client_max_body_size. Saukewa: S8 Saukewa:

6.5 CVE-2026-97629: Aiki tare da cikakken TLS maballin maɓalli Saukewa:

Canje-canje masu tasowa suna samuwa a src/event/ngx_event_openssl.c:

  ngx_memcpy(keys->elts, cache->ticket_keys,
-            2 * sizeof(ngx_ssl_ticket_key_t));
+            keys->nelts * sizeof(ngx_ssl_ticket_key_t));

Hoton na asali ya ƙunshi maɓalli uku, amma biyun farko kawai aka kwafi. Madadin haka, aiki tare bisa ainihin adadin abubuwan tsararru don tabbatar da cewa saitin maɓalli na Worker ya yi daidai da ƙwaƙwalwar da aka raba. Lokacin dubawa, kuma tabbatar da cewa rabon tsararru, ƙaddamarwa, kulle-kulle da dabaru na juyawa sun daidaita, maimakon kawai duba gyare-gyaren tsayin memcpy sau ɗaya. Saukewa: S9 Saukewa:

6.6 Me yasa ba a ba da shawarar yin amfani da gutsuttsuran facin da aka tarwatsa ba? Saukewa:

Waɗannan gyare-gyare guda biyar sun haɗa da src/http, src/stream, src/http/v3, da src/event bi da bi, kuma tsofaffin sigogin na iya samun bayanan tsaro da kari na hukuma. Bayarwa ya kamata ya samar da matrix mai zuwa: Saukewa:

Duba abu Saukewa:	Abin da dole ne a tabbatar Saukewa:
tushen faci Saukewa:	ƙaddamarwa na hukuma, sigar manufa mai dacewa, cikakken faci da tabbatar da sa hannu Saukewa:
Saitin faci na asali Saukewa:	Baya cin karo da gyare-gyare na tarihi kamar CVE-2026-42533, rarraba baya, da sauransu. Saukewa:
hanyar code Saukewa:	Rubutun HTTP + Stream, AIO/thread, HTTP/3, tikitin OpenSSL duk an rufe su Saukewa:
Haɗa mai jituwa Saukewa:	OpenSSL, PCRE, module ABI, modul mai ƙarfi da haɗin haɗin gwiwa sun daidaita. Saukewa:
koma bayan aiki Saukewa:	alias sake rubutawa, log ɗin mai ƙarfi, SSI/AIO, ɗorawa HTTP/3, sake dawowa zaman mTLS Saukewa:
lokacin gudu Saukewa:	Duk Worker/Pods suna gudanar da sabbin ingantattun gine-gine, babu hotunan gado da suka rage Saukewa:

Ga ƙungiyoyin da ke kula da fitowar nasu, ana ba da shawarar su kiyaye ID na faci, nau’ikan fakiti, gina rajistan ayyukan, da rahotannin koma baya ga kowane CVE; don aiki na yau da kullun da kiyayewa, mafita mafi aminci shine shigar da cikakken sabunta tsaro na mai siyarwa. Saukewa:

7. Tarihin rauni na baya baya, tsoffin rassan da sauran samfuran Saukewa:

7.1 NGINX ainihin raunin rauni wanda ya cancanci tabbatarwa lokaci guda daga Mayu zuwa Satumba 2026 Saukewa:

Yawancin lokuta NGINX waɗanda ba a sabunta su ba na dogon lokaci ba kawai sabon batun ya shafa a watan Oktoba ba. Wadannan su ne wakilan gyaran nodes a nan gaba: S1S2 Saukewa:

CVE Saukewa:	Farko gyara saki Saukewa:	Maɓallin haɗari da yanayin da ke buƙatar dubawa Saukewa:
CVE-2026-42945	Stable 1.30.1/Mainline 1.31.0, Mayu 13 Saukewa:	rewrite Rikicin regex mara izini da dabaru na maye gurbin yana haifar da ambaliya, yuwuwar RCE; akwai rahotannin jama’a na yunkurin kai hari a cikin daji Saukewa:
CVE-2026-9256	Stable 1.30.2 / Mainline 1.31.1, Mayu 22 Saukewa:	Matsakaicin kama regex da ƙimar tsayi a cikin rewrite yana haifar da ambaliya Saukewa:
CVE-2026-42055	Stable 1.30.3 / Mainline 1.31.2, Yuni 17 Saukewa:	HTTP/2 Takamaiman daidaitawa zuwa sama ko gRPC, babban yanayin buƙatun buƙatun yana haifar da ambaliya. Saukewa:
CVE-2026-42530	Mainline 1.31.2, Yuni 17 Saukewa:	HTTP/3 Amfani-Bayan-Kyauta; Alamar hukuma ta shafi kewayon 1.31.0–1.31.1 Saukewa:
CVE-2026-42533	Stable 1.30.4 / Mainline 1.31.3, Yuli 15 Saukewa:	map + regex kama m kimantawa yana haifar da ambaliya, kuma faci na gaba suna da alaƙar koma baya tare da CVE-2026-93479 a cikin Oktoba Saukewa:
CVE-2026-60005	Stable 1.30.4 / Mainline 1.31.3, Yuli 15 Saukewa:	ngx_http_slice_module Abubuwan da ke cikin ƙwaƙwalwar ajiya sun yoyo ƙarƙashin ƙayyadaddun yanayi na sabunta cache Saukewa:
CVE-2026-56434	Stable 1.30.4 / Mainline 1.31.3, Yuli 15 Saukewa:	SSI yana da alaƙa da UAF; ba daidai da root ya haifar da rashin lahani na Oktoba na AIO Saukewa:
CVE-2026-90439	Stable 1.30.5 / Mainline 1.31.6, Satumba 15	Iyakantaccen tulin ambaliya na HTTP/3 + takamaiman nau’in nau’in nau’in OpenSSL, wanda aka bayyana a matsayin ɓarna / iyakancewar ƙwaƙwalwar ajiya. Saukewa:

Sauran raunin irin su NGINX Core, HTTP/2, charset, da SMTP da aka sanar a cikin 2026 ya kamata kuma a bincika su bisa ga bayanan tsaro na hukuma; wannan tebur da gangan yana mai da hankali kan al’amuran yau da kullun waɗanda suka fi dacewa da na yanzu NGINX da ke fuskantar juzu’an tura wakilai na baya kuma suna da amincin ƙwaƙwalwar ajiya ko buƙatar abubuwan da suka dace. ba duk CVEs ba ne a cikin 2026. Jerin. Saukewa: S1 Saukewa:

Me yasa kulawa ta musamman ga CVE-2026-42945 Saukewa:

Akwai bayanan tsaro daga hukumomin gwamnati waɗanda ke yin rikodin ayyukan cin zarafi a cikin daji da bayanan amfani da jama’a don wannan raunin rewrite a watan Mayu. Don haka, ga al’amuran da ba a daɗe ba daga watan Mayu zuwa yanzu kuma suna da buɗaɗɗen rubutattun maganganu na yau da kullun akan hanyar sadarwar jama’a, ban da kammala gyara, haɗarin Worker mara kyau, rajistan shiga da canje-canje masu shakku a wancan lokacin yakamata a sake duba su. Saukewa: S23 Saukewa:

“An yi ƙoƙarin kai hari” ba ya tabbatar da kai tsaye cewa maharin ya aiwatar da umarni bisa ga kowane manufa; lokacin da aka haɗa martanin abin da ya faru, alamun sasantawa da hadarurruka ya kamata a bincika daban da shaidar gaskiya ta haɓaka ko dagewa. Saukewa:

Gyaran 7.2 don tsofaffin juzu’ai da wuraren rarrabawa Saukewa:

NGINX rassa daban-daban suna da nasu hawan keken tallafi da lokutan gabatarwa daban-daban na rauni. Sabbin faci guda biyar ba za a iya fitar da su zuwa duk bishiyar tushen farko ba tare da bita ba. Saukewa:

yanayi Saukewa:	Dabarun da aka ba da shawarar Saukewa:
Sigar sakin ta sanar da cikakkun facin tsaro Saukewa:	Yi amfani da fakitin mai siyarwa da rubuta cikakkun nau’ikan fakitin; Guji maye gurbin tare da binaries maras dacewa Saukewa:
Debian 12 da sauran fitowar da abin ya shafa waɗanda duk CVEs ba su rufe su ba tukuna a cikin wannan rukunin. Saukewa:	ƙaddamar da odar aikin haɗari, iyakance bayyanar waje, da duba matsayin mai kaya/ELTS; ƙaura ko amfani da sarkar saki mai tabbatarwa idan ya cancanta Saukewa:
Rassan tarihi waɗanda suka ƙare tallafi na sama Saukewa:	Ba da fifikon ƙaura zuwa nau’ikan da aka tallafa; idan ba da baya na ɗan gajeren lokaci ya zama dole, masu kula za su kimanta abin dogaro da daidaitawa, kuma su rubuta cikakkun gwaje-gwaje. Saukewa:
Ya zo tare da cokali mai yatsu na NGINX (OpenResty, Tengine, ƙofa na musamman) Saukewa:	Da farko ƙayyade ko an haɗa hanyar lambar daidai, sannan a yi amfani da bayanin tsaro na mai kula da cokali mai yatsa. Ba zai iya zama daidai kai tsaye da sigar sama ba. Saukewa:
Faci na tsaro yana haifar da canje-canje a ayyukan kasuwanci Saukewa:	Ɗauki matakan da aka tsara, canjin zirga-zirga tsakanin sigogin, da daidaitawa; bai dace a maido da sigar cibiyar sadarwar jama’a ba tare da warewa ba. Saukewa:

7.3 Rarrabe gyara don njs, Ingress da NGINX Core Saukewa:

• njs: Baya ga babban shirin NGINX, kuna buƙatar bincika sigar NGINX JavaScript module ɗin kanta. njs 1.0.2 yana gyara gajiyawar ƙwaƙwalwar ajiyar XML na Oktoba 2026 da batun rashin daidaituwar ingancin XML tare da halayen mahalli. Don tura aikin da ke da alaƙa da tabbatar da sa hannun XML ta amfani da nginx-saml, ya kamata ku ƙara karanta umarnin njs na hukuma don yanayin toshe-ciki. Saukewa: S20 Saukewa:
• F5 NGINX Plus/NGINX Mai Gudanar da Shiga: Ƙari, mai sarrafawa da Ƙofar Fabric kowane ɗayan yana da ƙarin bayanan tsaro, nau’ikan marufi daban-daban da raunin manufofin musamman. Haɓaka Layer ɗaya baya nufin sabunta wani Layer ta atomatik. Saukewa: S19
• Kubernetes Community ingress-nginx: Jami’an Kubernetes sun riga sun ba da sanarwar cewa mai sarrafa ya dakatar da kulawa a cikin Maris 2026, kuma ba za a iya rikita ma’ajiyar ta tare da mai sarrafa F5 ba. Kasuwancin da abin ya shafa yakamata su tsara ƙaura mai sauƙi kuma su tabbatar da bayanan Ingress da bambance-bambancen ma’anar Gateway API maimakon jiran sabon sigar tsaro. Saukewa: S21 Saukewa:

8. Sharuɗɗan yarda da bin diddigin binciken Saukewa:

Ana ba da shawarar cewa a yi amfani da jeri mai zuwa azaman sharuɗɗan karɓa don canjin odar aiki: Saukewa:

Aikin Saukewa:	Matsayin cancanta Saukewa:	Shaidar da za a iya riƙewa Saukewa:
Kari da ɗaukar hoto Saukewa:	Duk abubuwan da ke waje da haɗin kai kai tsaye waɗanda za su iya ƙetare CDN an ƙirƙira su. Saukewa:	Sunan yanki, LB, IP, Pod/jerin kwantena Saukewa:
Tushen fakiti da iyakar gyarawa Saukewa:	Yi amfani da sigar da aka tabbatar don rufe duk CVEs masu dacewa Saukewa:	Shawarwari na tsaro na sama, USN/DSA, sigar fakiti, narkar da hoto Saukewa:
tsohon tsari ya fita Saukewa:	Duk tsofaffin master/worker/kwantena an maye gurbinsu Saukewa:	PID/lokacin farawa, mirgina yanayin turawa, hoto mai gudana Saukewa:
Binciken tsari Saukewa:	An kawar da haɗuwa masu haɗari ko kuma an rufe su ta hanyar faci, kuma an tabbatar da alaƙar gado Saukewa:	sake fasalin taƙaitawa da rikodin duba na nginx -T Saukewa:
TLS/mTLS	Amintattun takaddun shaida sun wuce; takaddun shaida mara inganci ko ɓacewa an ƙi; Ci gaba da zama ba ya ƙetare tantancewa Saukewa:	Gwajin izini mara kyau/tabbatacce, sakamakon gwajin TLS mai sarrafawa Saukewa:
Rahoton da ya dace don HTTP/3 Saukewa:	Kunna kafaffen hanyar; Jikin roƙo na sama da srottling suna nuna daidai Saukewa:	HTTP/3, ƙaddamar da wakili, gwajin juzu’i mai iyaka Saukewa:
SSI/AIO	Ayyukan ya cika buƙatun, Worker ba shi da zubar da ciki mara kyau Saukewa:	Komawar kasuwanci, haɗari da saka idanu akan ƙimar kuskure Saukewa:
Aiki da kulawa da kulawa Saukewa:	Babu bayyanannen banda 5xx, SIGSEGV, tsari yana fita akai-akai Saukewa:	Alamomin sabis da rajistan ayyukan kafin da bayan canje-canje Saukewa:
Dabarun Rollback Saukewa:	Idan koma baya ya zama dole, farko iyakance bayyanarwa da adana iyakokin tsaro Saukewa:	Canza oda, Gudun Gaggawa, da Tsare-tsaren Keɓewa Saukewa:
zagayowar rayuwa ta gaba Saukewa:	Ƙayyade biyan kuɗin sanarwar tsaro, mitar sabunta akwati, da tsare-tsaren ƙaura na reshe Saukewa:	Haɓaka littafin, mai alhakin da kwanan wata dubawa na gaba Saukewa:

8.1 Me yakamata ku mai da hankali akai a cikin rajistan ayyukan da matsayin gudana? Saukewa:

Shirya matsala na rashin daidaituwa akan sabobin da aka fallasa na dogon lokaci worker process exited on signal , SIGSEGV , buƙatar gazawar spikes, mahaɗar hanyar samun hanyar da ba ta dace ba, TLS Zama ba zato ba tsammani/nasarar tantancewar jiki. Ana iya amfani da waɗannan alamun kawai azaman alamun bincike kuma basu da isassun shaida don tabbatar da kai tsaye cewa an yi amfani da wata CVE. ;Rashin rajistan ayyukan da suka dace bai tabbatar da cewa ba a kai hari ba. Saukewa:

8.2 An ba da shawarar ƙaddamar da kalmomi na ƙarshe na haɗari Saukewa:

Rahoton karɓa don yanayin samarwa yakamata yayi amfani da madaidaicin magana mai zuwa:

NGINX ƙofar sabis na waje da tushen fakitin software an gano su. Duk abubuwan da suka dace an haɓaka su zuwa sigar tsaro na hukuma, ko kuma an kammala aikin bayan da mai siyar ya tabbatar; an maye gurbin tsohon Worker da tsoffin kwantena. Laƙabin da ake laƙabi/sake rubutawa/taswira, AIO/SSI, HTTP/3 jikin buƙatun da TLS Tikitin Zama/mTLS an duba abubuwan da suka shafi saiti kuma sun wuce aiki, tabbatar da gwaji da buƙatar sakewa. Misalin da ba a gama haɓakawa ba tukuna, da yin rajistar wuraren fallasa, matakan diyya, masu alhakin, da kuma ƙarshen ƙarshe. Saukewa:

Idan facin na Debian 12 ko wasu sakewa har yanzu bai cika ba, bai dace a yanke hukunci gabaɗayan fam ɗin karɓa kamar yadda “an cika” ba; CVE da ba a warware ba, ko akwai daidaitaccen tsarin faɗakarwa, matsayin keɓewa da hanyar haɓakawa ta ƙarshe yakamata a yi rikodin su a fili. Saukewa:

---

Karin bayani: Abubuwan da aka kawo da kuma hanyoyin haɗin gwiwa Saukewa:

Bayani: Lambobin [Sx] a cikin rubutun sun yi daidai da wannan sashe. Abubuwan da ke biyowa suna ba da fifiko ga sanarwar tsaro na aikin gabaɗaya, ƙa’idodin ƙididdiga, sanarwar sakin kaya da bayanan hukumar tsaron ƙasa. An bayyana tsananin raunin raunin da aka ambata bisa ga ma’aunin ƙima na kowace ƙungiya mai bayarwa; ranar tabbatar da bayanai shine Oktoba 27, 2026. Saukewa:

S1 - NGINX Open Source Bayanin Tsaro na Jami’a Saukewa:

• https://nginx.org/en/security_advisories.html

Ya ƙunshi nau’ikan abubuwan da abin ya shafa, gyara rassan, da matakan tsananin hukuma na CVEs biyar na Oktoba, kuma ya shafi raunin tarihi har zuwa 2026. Saukewa:

S2 - NGINX rikodin sakin hukuma na hukuma Saukewa:

• https://nginx.org/news.html
• https://nginx.org/en/CHANGES-1.30

Tabbatar da 1.30.6 / 1.31.7 na 2026-10-14, 1.31.8 na 2026-10-21, da mahimman matakan tsaro na saki daga Mayu zuwa Satumba. Saukewa:

S3 - Hukumar Tsaro ta Cyber ta Singapore: F5 NGINX Mahimman rauni guda uku Saukewa:

• https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-150/

Bayanin makin CVSS v4.0 9.2, yanayin daidaitawa da ake buƙata, da shawarwarin ragewa na wucin gadi don CVE-2026-15176, CVE-2026-93479, da CVE-2026-97205. Saukewa:

S4 - NHS Ingila: F5 NGINX Babban shawara mai haɗari Saukewa:

• https://digital.nhs.uk/cyber-alerts/2026/cc-4872

Yana bayyana tasirin DoS / yuwuwar RCE na al’amuran amincin ƙwaƙwalwar ajiya, da ƙuntatawa kamar ASLR da aka kashe ko ketare. Saukewa:

S5 - Madogararsa na hukuma: CVE-2026-15176 Saukewa:

• https://github.com/nginx/nginx/commit/f8a23425bd6840c4c36b4264edf576ba3646156f

Yayi daidai da duban matsayi na alias da r->uri_changed a cikin ngx_http_map_uri_to_path(). Saukewa:

S6 - Asalin asali na hukuma: CVE-2026-93479 Saukewa:

• https://github.com/nginx/nginx/commit/6aa4b3fdd4fdc156153f2981eb4070690624447c

Daidai da tsayin rubutun HTTP/Stream da kuma tanadin dabaru na rarraba buffer. Saukewa:

S7 - Madogararsa na hukuma: CVE-2026-97205 Saukewa:

• https://github.com/nginx/nginx/commit/6adfc05ece48f92446383ec1f145446848694698

Yayi daidai da ƙidayar ƙidayar r->main->blocked NGX_HTTP_MAX_BLOCKED 250 da faɗuwar hanyar asynchronous. Saukewa:

S8 - Madogararsa na hukuma: CVE-2026-95101 Saukewa:

• https://github.com/nginx/nginx/commit/1c173a2d8767730e678c27446138d7ae5dd6fd64

Rabuwar matsayi daidai da HTTP/3 da ba a san firam ɗin da ya rage ba da kuma DATA buƙatar tsayin jiki. Saukewa:

S9 - Asalin tushe na hukuma: CVE-2026-97629 Saukewa:

• https://github.com/nginx/nginx/commit/1916f26e6ca49296568633d309777e36527e5bb2

Yayi daidai da duk maɓallan maɓalli yayin aiki tare TLS Juyin Tikitin Zama. Saukewa:

S10 — F5: CVE-2026-15176 Sanarwa ta Mai siyarwa Saukewa:

• https://my.f5.com/manage/s/article/K000162416

Jera abubuwan da ke jawo abubuwa kamar alias, rewrite, $request_filename da rajistan ayyukan shiga. Saukewa:

S11 — F5: CVE-2026-93479 Sanarwa mai siyarwa Saukewa:

• https://my.f5.com/manage/s/article/K000162607

Yi lissafin taswirar regex, hanyar root, da yanayin kimanta madaidaicin log. Saukewa:

S12 - NGINX na hukuma TLS/SSL takaddun takaddun bayanai Saukewa:

• https://nginx.org/en/docs/http/ngx_http_ssl_module.html

Bayanin ssl_session_cache, ssl_session_tickets, ssl_session_ticket_key da takardar shaidar abokin ciniki da sauran umarni. Saukewa:

S13 — Shawarar tsaro Saukewa:: Ubuntu USN-8955-1 (2026-10-26)

• https://ubuntu.com/security/notices/USN-8955-1

Bayar da cikakkiyar sigar ƙayyadaddun fakitin software da iyakar rarrabawar Ubuntu 22.04/24.04/26.04/26.10. Saukewa:

S14 — Shawarar tsaro Saukewa:: Debian DSA-6575-1 (2026-10-21)

• https://lists.debian.org/debian-security-announce/2026/msg00490.html

Tabbatar da fakitin gyaran tsaro 1.26.3-3+deb13u10 don Debian 13/trixie, da yin rikodin ƙungiyar baya don CVE-2026-93479. Saukewa:

S15 — Binciken rauni: Debian Security Tracker: CVE-2026-15176

• https://security-tracker.debian.org/tracker/CVE-2026-15176

An yi amfani da shi don tabbatar da matsayin gyaran rarraba na Debian 12 / bookworm da Debian 13 / trixie. Wannan matsayi na iya canzawa tare da sabunta tsaro na gaba. Saukewa:

S16 — Binciken rauni: Debian Security Tracker: CVE-2026-95101

• https://security-tracker.debian.org/tracker/CVE-2026-95101

Ƙarin tabbaci na matsayin tsaro na raunin HTTP/3 akan rassan Debian daban-daban. Saukewa:

S17 — Shawarar tsaro Saukewa:: Red Hat: CVE-2026-93479

• https://access.redhat.com/security/cve/cve-2026-93479

Ƙarin fahimtar alaƙa tsakanin rashin lahani na koma bayan Oktoba da gyara ga Yuli CVE-2026-42533. Saukewa:

S18 - NGINX daftarin aiki na juzu’i na wakili Saukewa:

• https://nginx.org/en/docs/http/ngx_http_proxy_module.html
• https://nginx.org/en/docs/http/ngx_http_core_module.html

Nemi ma’anar ma’anar da tsoffin ƙima na daidaitawa kamar proxy_request_buffering, client_max_body_size, alias, aio, da sauransu. Saukewa:

S19 - NGINX Plus Bayanan Bayani na Sakin Aiki Saukewa:

• https://docs.nginx.com/nginx/releases/

List Plus CR/LTS rassan, iri, faci da haɓaka masu tuni masu dacewa. Saukewa:

S20 — NGINX JavaScript / njs Takardun Tsaro na Jami’a Saukewa:

• https://nginx.org/en/docs/njs/security.html
• https://nginx.org/en/docs/njs/changes.html

Ya ƙunshi Oktoba 2026 njs 1.0.2 da ingantawar XML masu alaƙa, batutuwan gajiyar ƙwaƙwalwar ajiya. Saukewa:

S21 - Kubernetes: Community ingress-nginx umarnin yin ritaya na hukuma Saukewa:

• https://kubernetes.io/blog/2025/11/11/ingress-nginx-retirement/
• https://kubernetes.io/blog/2026/01/29/ingress-nginx-statement/

Lura cewa aikin ya dakatar da sabbin abubuwan sakewa da gyare-gyaren tsaro a cikin Maris 2026, kuma ana ba da shawarar yin ƙaura mai sarrafawa ko Gateway API. Saukewa:

S22 - NGINX sarrafa sabis na hukuma da umarnin haɓaka binaryar kan layi Saukewa:

• https://nginx.org/en/docs/control.html

Bambance sake ɗorawa, sake farawa da hanyoyin haɓaka fayil ɗin da za a iya aiwatarwa akan layi don karɓar karɓar tsari. Saukewa:

S23 - Sanarwa Tsaro na Gwamnati: Mayu 2026 NGINX sake rubuta rauni Saukewa:

• https://its.ny.gov/2026-051
• https://www.govcert.gov.hk/en/alerts_detail.php?id=1881

Bayar da bayanan haɗarin tarihi da shawarwarin sabunta tsaro don CVE-2026-42945; hukunce-hukuncen da suka shafi cin zarafi a cikin daji ya kamata su kasance bisa sanarwar hukumar a lokacin da kuma ƙarin shaidar abin da ya faru. Saukewa:

S24 — F5: CVE-2026-95101 da CVE-2026-97629 Sanarwa na Mai siyarwa Saukewa:

• https://my.f5.com/manage/s/article/K000162613
• https://my.f5.com/manage/s/article/K000162606

Yana rufe haɗarin HTTP/3 buƙatar allurar jiki da jujjuyawar maɓallin tikitin TLS ta atomatik bi da bi. Saukewa:

S25 — F5: CVE-2026-97205 Sanarwa ta Mai siyarwa Saukewa:

• https://my.f5.com/manage/s/article/K000162608

Bayanin SSI/AIO yana haifar da yanayi da yuwuwar lalacewar ƙwaƙwalwar ajiya. Saukewa:

NGINX sabunta tsaro: dubawar sanyi, haɓakawa da tabbatarwa Saukewa: