NGINX adịghị ike: ihe kpatara, ndozi na nkwenye mmepụta

Ụbọchị akụkọ akụkọ ihe mere eme: 2026-10-14 (mkpughe na ụbọchị mwepụta nchekwa). enyochara isi mmalite yana agbakwunyere ozi site na 2026-10-27.

Edere akụkọ a site na ụbọchị mmemme; mbipute na mmelite ewepụtara mgbe Ọktoba 14 ga-esonye n’okpuru. Ndị na-ege ntị: NGINX Open Source / NGINX Plus webụsaịtị na ntụgharị ọrụ proxy na ndị ọrụ ndozi, ndị ọrụ nzaghachi nchekwa, ndị na-echekwa nkesa, yana ndị injinia na-achịkọta onwe ha NGINX ma na-edobe modul ndị ọzọ.

Edemede a lekwasịrị anya na ọghọm isi NGINX ise nke ekpughere ma dozie ya na Ọktoba 14, 2026, ma na-elekwa anya azụ na nchekwa nchekwa nchekwa nnọchite anya wee rịọ adịghị ike iguzosi ike n’ezi ihe site na Mee ruo Septemba 2026. Ọdịnaya ahụ na-ekpuchi ọnọdụ ịkpalite, ọkwa ọkwa koodu, akpata mbelata ọrụ mgbasa ozi, mbelata ọrụ mgbasa ozi, mbelata ọrụ mgbasa ozi. backports ka ochie alaka na mmepụta nkwenye. Ntụtụ aka dị ka S1 jikọtara na mgbakwunye isi mmalite. A na-eji nhazi ihe atụ naanị iji gosipụta echiche mbugharị na nyocha, ma kwesị ekwesị ka enyocha ya dabere na ụdị n’ezie, ihe nketa nhazi, ndabere, na ikike azụmahịa tupu mmejuputa ya.

TL;DR: Omume ndị mbụ

1. Welite nkwalite nchekwa ụzọ. Maka nginx.org Mepee ngwugwu isi mmalite, melite Stable 1.30 alaka ka ọ dịkarịa ala 1.30.6 na nke Mainline 1.31 alaka ka ọ dịkarịa ala 1.31.7. N’ụbọchị nkwenye, 1.31.8 bụ ọhụrụ Mainline ntọhapụ. Ndị a bụ ntọala ngalaba dị iche iche; atụla ọnụ ọgụgụ ha n’ofe alaka. S1 S2
2. Nyochaa nrụnye nkesa site na ụdị ngwugwu zuru ezu. Ubuntu 22.04 / 24.04 / 26.04 / 26.10 nwere ndị na-ere ahịa azụ azụ; Debian 13 (trixie) chọrọ opekata mpe 1.26.3-3+deb13u10. Na nkwenye, ngwugwu Debian 12 (bookworm) 1.22.1-9+deb12u10 ka na-emetụta ya. Lelee CVE nke ọ bụla; Ndụmọdụ Debian 13 egosighi na edobere Debian 12. S13S14S15
3. Nyochaa ngwakọta nhazi ise: alias + rewrite + $request_filename , map + nyocha regex + mgbanwe, aio + ssi + include virtual , HTTP/3 ya na proxy_request_buffering on , na ssl_session_cache shared:... na akpaka TLS Ntụgharị igodo tiketi nnọkọ. Ọnụnọ nke ntuziaka naanị anaghị ewepụta nrigbu; nyochaa ụzọ arịrịọ na oke nhazi. S1 S3 S4
4. Dochie usoro ochie na arịa niile. Gbaa nginx -t, wee malitegharịa ọrụ ahụ ma ọ bụ rụọ ọrụ mbugharị nnweta dị elu. Kwenye na usoro master/worker ochie apụọla; nginx -s reload naanị egosighi na ọnụọgụ abụọ na-agba ọsọ agbanweela.
5. Nyochaa n’ezie njedebe njedebe: HTTP/1.1, HTTP/2, HTTP/3 ma ọ bụrụ na enyere ya aka, bulite proxied na API ozu arịrịọ, mTLS nzere asambodo, SSI ibe. Dekọọ njirimara ngwugwu, ụdị, mgbari onyonyo, usoro na-agba ọsọ na nsonaazụ maka njedebe njedebe ọ bụla.
6. Ọ bụrụ na nkwalite ozugbo agaghị ekwe omume, wepụ ọnọdụ mkpalite ọdabara: gbanyụọ adịghị mkpa SSI / AIO ma ọ bụ HTTP/3 , nyochaa adịghị ike alias / rewrite / map nrụtụ aka na-agbanwe agbanwe, ma nyochaa nwa oge ssl_session_tickets off; maka emetụtara mTLS ọrụ. WAF , ASLR , oke ọnụego na mgbanwe nhazi na-ekpuchi naanị ọnọdụ ụfọdụ na enweghị ike dochie patches ndị ọrụ. S3 S4 S8 S12

1. Nleba anya ihe ọghọm na ikpe ihe egwu

NGINX wepụtara 1.30.6 (Stable) na 1.31.7 (Mainline) na Ọktoba 14, 2026, na-edozi nsogbu nchekwa ise. Atọ gụnyere oke oke oke ma ọ bụ iji ya emechaa n’efu wee nata F5 CVSS v4.0 akara nke 9.2 / Critical. Abụọ ndị ọzọ na-emetụta HTTP/3 arịrịọ iguzosi ike n’ezi ihe na TLS ahịa akwụkwọ nyocha. S1S2S3

Chọpụta usoro nhazi ọkwa: nginx.org depụtara okwu ise niile dị ka medium, ebe F5 CVSS v4.0 na ụfọdụ ụlọ ọrụ nchekwa obodo na-ekewa okwu ebe nchekwa atọ dị ka Critical. Nke a apụtaghị na ise niile na-enye ohere igbu koodu ime obodo na-enweghị atụ. Nhazi, nnweta okporo ụzọ na ọnọdụ na-abụghị ihe njikwa onye mwakpo. Nrụrụ ebe nchekwa na RCE a pụrụ ịdabere na ya bụ ọkwa dị iche iche. S1S3S4

CVE	Usoro nka na ụzụ na ọnọdụ akpalite ahụkarị	isi mmetụta	Nlele na mkpofu
CVE-2026-15176	alias nkewa ụzọ + rewrite gbanwere URI + nyocha $request_filename	Okpokoro ihe njupụta, okuku Worker; enwere ike RCE n’okpuru ọnọdụ ụfọdụ	F5 CVSS v4.0 9.2; nye ụzọ nchọpụta nsogbu ụzọ
CVE-2026-93479	Nyocha ederede HTTP/Stream, ọkachasị map regex njide na akwụkwọ ndekọ aha root, log na-agbanwe ntụgharị ntụgharị.	A na-edegharị ihe nchekwa echekwabara ma obo ahụ tojuru; enwere ike RCE n’okpuru ọnọdụ ụfọdụ	F5 CVSS v4.0 9.2; bụ ihe ize ndụ nlọghachi azụ mgbe mmezigharị gara aga
CVE-2026-97205	SSI mebere na-agụnye yana AIO/arụ ọrụ asynchronous; pụtara oke ọrụ ọnụ oke	Jiri-Mgbe-efu, Worker okuku, ebe nchekwa nrụrụ; enwere ike RCE	F5 CVSS v4.0 9.2; chọrọ nhazi na-abụghị nke ndabara
CVE-2026-95101	HTTP/3 Frame amaghi ama na-ekewa n’ofe nchekwa nchekwa, agbanyere ihe nchekwa ahụ arịrịọ proxy	Ịgbanye bytes na-abụghị DATA na ezighi ezi n’ime ahụ arịrịọ dị elu, ikekwe gafere oke nha nke arịrịọ ahụ.	Nke a adịghị ike na-emetụta iguzosi ike n’ezi ihe nke arịrịọ. Ọ bụghị n’onwe ya na-enye mpụ koodu mkpochapụ (RCE).
CVE-2026-97629	Cache nnọkọ TLS ekekọrịtara, ntụgharị igodo akpaka na ntụgharị igodo Worker	Ụgha tiketi nnọkọ; Nyocha akwụkwọ ikike ndị ahịa nwere ike ime maka ọrụ mTLS emetụtara	Ekwesịrị itinye nlebara anya pụrụ iche na mmetụta azụmaahịa nke ụdị njirimara asambodo API.

Akara CVSS dị n’elu bụ F5 na-eji v4.0; Otu adịghị ike ahụ nwere ike igosi ịdị njọ dị iche iche na CVSS 3.1, nginx.org akara ule nke ya na ogo nkesa ike. S1S3S4

1.1 na-ebute mkpughe mbugharị ụzọ karịa akara CVE naanị

Ụdị ntinye	Isi ihe nyocha	Ntụnye mkpa mkpofu
Onye nnọchi anya netwọkụ netwọk ọha, gụnyere ahaziri rewrite, alias, yana mgbagwoju map	CVE-2026-15176, CVE-2026-93479 wee degharịa / maapụ adịghị ike site na Mee ruo Julaị	P0: Nyochaa ma melite ozugbo
API / Management ụgbọ elu iji ahịa akwụkwọ dị ka naanị ma ọ bụ isi nbata nyocha	Tiketi nnọkọ yana nhazi cache nkekọrịta nke CVE-2026-97629	P0: kwenye ozugbo oke nyocha na nwelite
Nye mbulite HTTP/3 mpụga, interface mgbanwe ọkwa, klas azụmahịa API	CVE-2026-95101, ọkachasị ahụ na-arịọ arịrịọ bụ proxied na azụ azụ	P0/P1: Hazie dịka mkpa azụmahịa siri dị
SSI Ibe akwụkwọ dị omimi ma ọ bụ faịlụ asynchronous I/O	CVE-2026-97205	P1: Kwado ọnọdụ nchikota ma rụkwaa ozugbo enwere ike
Naanị ibe kwụ ọtọ + dị mfe HTTP/1.1/2 proxy reverse	Nhazi na ụdị ka kwesịrị ka enyocha ya, mana ụfọdụ ọnọdụ CVE nwere ike na-efu	P1: Tinyere na windo nkwalite nchekwa mberede
Jiri Kubernetes Community ingress-nginx lara ezumike nká	Ihe oru ngo a na-akwụsị mmezi nchekwa, na ihe ize ndụ na-ejedebeghị na CVE ise ndị a	Mee atụmatụ mbugharị onye njikwa n’otu n’otu

P0/P1 bụ ọrụ na ntụnye mkpofu a na-enye n’ime edemede a maka ikpughe netwọk ọha na ikike nzere. Ọ bụghị ọkwa CVSS gọọmentị, ma ọ bụ na ọ gaghị edochi uru dị n’ime ụlọ ọrụ ma gbanwee ntule ihe egwu.

Oke mmetụta 1.2 ikike mbuso agha

Isi adịghị ike dị na batch a bụ nke dị na NGINX Data Plane: ebe ntinye mbuso agha bụ njikọ na arịrịọ ndị ahịa, mmetụta ya na-emekarị na usoro Worker. Ọ bụrụ na ezutere ọnọdụ nrụrụ aka nke ebe nchekwa, ikike mmezu koodu na-amachibidokarị onye ọrụ na-agba ọsọ, ihe mgbochi akpa, ikike Linux, ịgbanye na ikike netwọkụ nke Worker; ikike RCE apụtaghị na akpaghị aka ikike root ma ọ bụ nnabata nnabata. S4

Mana ọbụlagodi na usoro a enweghị ihe ùgwù, ọ ka nwere ike nweta nzere proxy, faịlụ enwere ike nwere igodo nzuzo, akara ọrụ elu, faịlụ nwa oge, API dị n’ime, yana netwọk enwere ike iru. Maka mTLS, ngafe nyocha n’onwe ya nwere ike bụrụ nsonaazụ azụmahịa siri ike, na ọ bụchaghị na koodu mmebe ga-esonyere ya.

2. Ihe kpatara nyocha

2.1 Ghọta oke oke atọ nwere mmejọ na NGINX

Otu NGINX worker bụ ogologo ndụ, usoro mmemme na-akwalite nke na-akwado ọkwa arịrịọ, ọrụ asynchronous na protocol parsers. Nke a adịghị ike na-agụnye ihe mgbochi na ọkwa injinia atọ:

1. Ntụle mgbanwe na nha ebe nchekwa aghaghị ịdị na-agbanwe agbanwe: rewrite Mgbe ịgbanwere arịrịọ URI, nkewa ụzọ ga-adabarịrị na nke dị ugbu a location; mgbe onye ntụgharị ederede na-agbakọ ogologo agbanwe agbanwe, oghere ederede ga-ekpuchirịrị nsonaazụ na mpaghara echekwara.
2. Asynchronous arụmọrụ ga-agbatịkwu okirikiri ndụ nke ebe nchekwa a rịọrọ: Mgbe enwere ịgụ na ide faịlụ emechabeghị, nchere cache ma ọ bụ ọrụ eri, enweghị ike iwepụta ọdọ mmiri ebe nchekwa dị mkpa tupu oge eruo.
3. Enweghị ike ịgwakọta ma ọ bụ hapụ ọkwa usoro protocol na ọkwa nchekwa: HTTP/3 Ogologo oge mwụpụ etiti amaghi ama dịka DATA arịrịọ ogologo ahụ; TLS Oghere igodo niile na-esonye na nkwenye mbinye aka ga-enwerịrị ibido ma mekọrịta ya n’oge ntụgharị tiketi nnọkọ.

Ọdịnaya na-esote dabere na NGINX upstream fix commitment na onye na-ere ahịa iji kọwaa usoro ọdịda nke enwere ike ịkpalite; iberibe ihe atụ bụ maka nyocha, ọ bụghị koodu zuru oke nke enwere ike iji mee ihe ozugbo iji rụkwaa ebe mmepụta ihe. S5S6S7S8S9

2.2 CVE-2026-15176: Usoro nkewa n’etiti alias na edegharịrị URI adịghị mma.

Na NGINX, location dakọtara na alias na-ekpebi ụzọ faịlụ; rewrite nwere ike ịgbanwe arịrịọ ugbu a URI. Mgbe idegharịgharị, echiche ndị mbụ location maapụ nwere ike ọ gaghị adịgide.

Ụzọ nhazi emetụtaghị nke ọma ma e degharịrị arịrịọ a mgbe ị na-elele ọkwa alias na ngx_http_map_uri_to_path(). Mgbe nhazi ahụ na-aga n’ihu na-enyocha $request_filename mgbe e degharịrị, enwere ike ịmepụta ụzọ ahụ site n’echiche ndị na-adabaghị na ọnọdụ URI dị ugbu a, na-emecha na-eme ka mpụ na-ede akwụkwọ na ebe nchekwa. S5

Ngwakọta a na-ahụkarị (naanị eji dị ka ihe nlere anya maka nyocha nhazi, anaghị atụ aro ibunye ya):

# 仅用于识别风险模式：不是修复配置
location /foo/ {
    alias /srv/alias-root/;
    rewrite ^/foo/.*$ /new-path;
    return 200 $request_filename;
}

Ihe ize ndụ ahụ ejedebeghị na return: set, if, add_header, log_format, wdg nwekwara mkpa ka enyocha ya ma ọ bụrụ na $request_filename nyocha na-akpalite na otu usoro arịrịọ. return na ihe atụ na-eme ka ụzọ steeti a dị mfe ịhụ, enweghị ike iji ya mee ka ọ pụta ìhè na nhazi mmepụta niile ga-emepụta oke mmiri. S5S10

Nsonaazụ nke mbuso agha: Ịrụ arịrịọ nwere ike ime ka Worker malitegharịa ma ọ bụ nkwụsị ọrụ; N’okpuru ọnọdụ dịka ASLR na-emechi ma ọ bụ nwee ike ịgafe ya, enwere ike RCE. Isi ihe dị na patch nke dị n’elu bụ ịjụ imecha maapụ ụzọ URI edegharịrị na ọnọdụ alias nke na-adịkwaghị adị, kama ịgbasa naanị ihe nchekwa. S5S10

2.3 CVE-2026-93479: adabaghị n’etiti “ohere echekwara” na ezigbo ogologo mgbanwe na nyocha edemede

Ụdị HTTP na Stream nke NGINX nwere ndị nyocha edemede na-ejikọta eriri nkịtị na ụkpụrụ agbanwe agbanwe n’ime eriri nsonaazụ. Ọmụmaatụ ngwa gụnyere ụzọ HTTP akwụkwọ root, ụzọ ntinye akwụkwọ, na okwu mgbanwe na Stream.

Ụfọdụ nhazi nke map + okwu oge niile na-enye ohere ka e jiri okwu ndị ọzọ gụọ ụkpụrụ ejidere tupu enyocha mgbanwe nsonaazụ map. Ejikọtara ya na usoro mmebe script nwere ogologo echekwabara, mmejuputa ochie ga-agụta oghere len echekwabara n’ime ogologo mkpokọta enyochala tupu oge eruo, nke mere na ngụkọ ihe nrịbama ederede na-esote anaghị adaba na oke nchekwa. N’ime usoro ntule mgbanwe dị iche iche, eriri na-esote nwere ike degharịa mpaghara echekwara, na-ebute oke oke. S6

ihe ntinye aka	Ihe mere o ji dị mma ịṅa ntị
regex na map	Ntule na-agbanwe agbanwe nwere ike ịnwe usoro ndụ onwe ya na omume caching
Mweghara amaghị aha dị ka $1, $2, wdg.	Edere ya ngwa ngwa site na okwu ma ọ bụ okwu ndị ọzọ mgbe niile, na-eme ka ọ sie ike ịchọta nwe
Mgbanwe na root	Ndobe ederede na ndoputa ihe mgbe ị na-ebuli ụlọ ụzọ
log_format/Dzọ ndekọ aha na-agbanwe agbanwe	Enwere ike ịkpalite otu ụdị nyocha ahụ ma emechaa na arịrịọ ahụ
Okwu ederede na stream	Ndozi mgbago elu na-agbanwekwa ngx_stream_script_run(). Ị nweghị ike ịlele modul HTTP naanị.

Mmekọrịta nlọghachi azụ dị mkpa: Koodu metụtara adịghị ike a metụtara mgbanwe ndị gara aga nke edobere CVE-2026-42533. DSA gọọmentị maka Debian 13 na-ekwu n’ụzọ doro anya na ewebatara koodu emetụtara na ngwugwu trixie site na nchekwa nchekwa mbụ. Ya mere, “July map vulnerability patch ka etinyere” apụtaghị na ekpuchiwo CVE-2026-93479 nke October; Ekwesịrị ịlele yinye ndozi nchekwa zuru oke. S6S14S17

Ihe ize ndụ RCE nwere ike ime ebe a metụtara ebe nchekwa nchekwa, na e kwesịghị ikwu na map regex naanị ga-enwe ike irigbu ya site n’aka ndị mwakpo na-amaghị aha. S11

2.4 CVE-2026-97205: AIO Ọnụ ọrụ emechabeghị ọnụ ihe mkpuchi na-akpata ojiji-Mgbe-efu.

Nke a adịghị ike abụghị naanị “gbanye SSI na ị ga-enweta UAF”. Igodo dị na ọnụọgụ ntụaka ọrụ asynchronous nke isi arịrịọ nwere.

NGINX Jiri r->main->blocked soro nhazi asynchronous nke emechabeghị, na mmejuputa ochie ọ bụ ọnụọgụ 8-bit; ụzọ ụfọdụ emeghị nlele oke oke tupu ha abawanye ọnụ. Mgbe otu isi arịrịọ ahụ na-agbakọ ọrụ 256 pụtara ìhè, ọnụ ọgụgụ ahụ nwere ike kechie site na 255 ruo 0. Usoro ndị na-esote ga-ekwenye n’ụzọ ezighi ezi na ọ nweghị ọrụ asynchronous na-egbochi arịrịọ ahụ ka ahapụ ya, si otú a na-ahapụ ọdọ mmiri ebe nchekwa arịrịọ nke a ka na-ezo aka na ọrụ ahụ. S7

Enwere ike kewaa usoro ọdịda ahụ na:

1. Site na agbanyere ụzọ asynchronous I/O/thread jikọtara ya, ibe SSI na-ewebata ọtụtụ arịrịọ ma ọ bụ gụọ ọrụ site na include virtual.
2. A na-akwakọba arụmọrụ pụtara ìhè nke otu isi arịrịọ ruo oke oke nke mpaghara ọnụ ọgụgụ nọchiri anya ya.
3. Ọnụọgụ 8-bit gbara gburugburu, akọwapụtaghị nke ọma dị ka “enweghị ọrụ na-echere”.
4. A na-ewepụta ọdọ mmiri ebe nchekwa arịrịọ, ka faịlụ na-agụ, cache na-echere, ma ọ bụ nkwughachi nke ọrụ eri ka na-ejigide ntụaka na ya.
5. Ndaghachi oku mmecha asynchronous na-esote na-enweta ebe nchekwa ewepụtara, butere UAF, Worker daa ma ọ bụ nrụrụ ebe nchekwa nwere ike.

Ndozi ọrụ ahụ na-agbakwụnye NGX_HTTP_MAX_BLOCKED 250 na faịlụ nkụnye eji isi mee ihe, ma na-agbakwụnye ihe mgbochi na nzacha mmepụta, ịgụ cache, na ụzọ eriri elu; Mgbe a rutere n’ọnụ ụzọ, arụ ọrụ nwere ụzọ mekọrịtara ọnụ na-arụkọ ọrụ ọnụ, ma ọ bụrụ na enweghị ike ịhazi ya n’enweghị nsogbu, a ga-ajụ mgbakwunye ọzọ nke ọrụ na-echere. S7

Mkpebi ikpe: A ga-enyocharịrị ma SSI, AIO, ntinye mebere, arịrịọ subrequest na arụmọrụ asynchronous nwere ike ime na ngwakọta n’otu agbụ arịrịọ ahụ. Ndị a anaghị abụkarị nhazi proxy static dị larịị. aio off; ma ọ bụ ssi off; nwere ike wepụ ihe ndị na-akpalite kpọmkwem, mana a ga-ebu ụzọ kwenye ịdabere na ọrụ azụmahịa. S4S7S25

2.5 CVE-2026-95101: HTTP/3 amaghi etiti na mgbagwoju anya na ọnọdụ nke DATA arịrịọ ahu

Ihe ntụgharị etiti HTTP/3 ga-amarịrị ọdịiche dị n’etiti okpokolo agba DATA (nke a ga-ebufe na nhazi arịrịọ HTTP) yana okpokolo agba amabeghị nke ekwesịrị ịwụpụ. Ogologo nke okpokolo agba amaghi ama ga-echekwarịrị nke ọma mgbe a na-ekewa n’ofe nchekwa netwọkụ.

Mmezu ochie nke ngx_http_v3_parse_data() jiri mpaghara st->length chekwaa “ọnụọgụ bytes fọdụrụ ka a ga-awụpụ” mgbe ị na-amafe okpokolo agba amaghi ama, ebe nzacha ahụ na-arịọ arịrịọ tụgharịrị otu ubi ahụ dị ka “ogologo DATA fọdụrụnụ”. Ọ bụrụ na okpokolo agba amaghi ama mere n’ọtụtụ oku nzagharị, enwere ike imehie ogbe bytes na-esote ka emechara nlegharị anya dị ka akụkụ nke ahụ arịrịọ. S8

Ụdị ihe egwu abụọ na-ebilite:

• Rịọ ogbugba ahụ: Enwere ike ibunye ụgwọ akwụ ụgwọ na-abụghị nke DATA nke onye ahịa nyefere na ngwa elu, na-agbanwe data nke azụ azụ nwetara n’ezie.
• ngafe nha nha: client_max_body_size na mgbochi ndị ọzọ. Nlebanya ndị a na-atụ anya ka etinyere n’ụzọ DATA, yana ọdịnaya agbanweghị ezighi ezi nwere ike gafere nkwenye kwekọrọ.

Ihe omume na-akpalite nke onye ọrụ gọọmentị kọwara bụ mgbe ngx_http_v3_module natara arịrịọ HTTP/3 wee zipu proxy_request_buffering on. A na-akwado nkwado ahụ proxy site na ndabara na ngx_http_proxy_module. Ya mere, a ga-ebu ụzọ lelee proxy reverse nke na-agbanye HTTP/3. O kwesịghị ekwesị iche na ọ dịghị ọnọdụ mkpalite naanị n’ihi na edeghị proxy_request_buffering on; n’ụzọ doro anya. S8S18

Nsonaazụ nke adịghị ike a bụ nke nkwụghachi azụ arịrịọ iguzosi ike n’ezi ihe na mgbanwe ókèala nchekwa, nke na-abụghị nke okwu RCE dechara ozugbo na isi NGINX. Mmetụta azụmaahịa kacha adabere n’otu esi atụgharị bytes ndị a na ntụkwasị obi elu. S24

2.6 CVE-2026-97629: TLS ntụgharị tiketi tụfuru oghere igodo nke atọ

Na nhazi emetụtara, NGINX nwere ike ịmepụta na tụgharịa TLS igodo nnọkọ site na cache ebe nchekwa nkekọrịta, na-enye ohere ka ọtụtụ Worker hazie otu batch nke tiketi.

Ihe mgbagha mmekọrịta dị mkpa na-ekenye oghere igodo 3 maka Worker nke ọ bụla, na oku nbipu ga-agafe oghere ndị a; ma ochie mmejuputa iwu naanị oyiri 2 isi ohere mpere si òkè ebe nchekwa oge ọ bụla, na-akpata isi aha, HMAC igodo na AES nke atọ oghere. Igodo ahụ nwere ike ịnọgide na-ebughị ụzọ. Ọ bụrụ na njirimara igodo nke tiketi dabara na ọkwa a, enwere ike iji ihe isi ihe na-enweghị mmalite maka nkwenye mbinye aka na mwepu, si otú a na-etolite ụzọ iji chepụta nnọkọ TLS. S9

Ngwakọta ibunye ihe egwu dị elu na-abụkarị:

# 仅为排查触发条件所示：共享缓存本身不是恶意配置
ssl_session_cache shared:SSL:10m;
# 未显式配置 ssl_session_ticket_key 文件，使用自动轮换机制

Nsonaazụ azụmaahịa kacha njọ sitere na adịghị ike a bụ na na ọrụ ndị na-eji nyocha asambodo ndị ahịa (mTLS) na ssl_verify_client on; na ụzọ ndị ọzọ, oge mgbake adịgboroja nwere ike gafere nkwenye asambodo ndị ahịa. Ọganihu nke mwakpo ahụ dịkwa n’okpuru ọnọdụ enweghị nchịkwa; saịtị nke na-eji naanị asambodo HTTPS n’akụkụ ihe nkesa na-enweghị nyocha nke onye ahịa ekwesịghị ịkọwapụta ya dị ka “onye na-awakpo nwere ike gafere nbanye webụsaịtị niile.” S9S12

Nke a bụ okwu nyocha ọkwa nnọkọ TLS na enweghị ihe jikọrọ ya na igodo nzuzo TLS nke sava ahụ agbawara ma ọ bụ na emetụtara asambodo CA root ọha. S24

2.7 Otu esi aghọta DoS, RCE, ngafe nyocha na nrigbu amaara

• DoS: Njehie ebe nchekwa na-eme ka Worker daa ma ọ bụ malitegharịa nke ukwuu. Ma ọ na-akpata enweghị nnweta n’ozuzu ya metụtara nrụgide okporo ụzọ, ikike ịmalitegharị usoro, oge mmezi njikọ yana ihe nrụpụta dị elu.
• nwere ike RCE: Ụfọdụ ọkwa na-egosi na enwere ike ịme koodu mgbe emechiri ma ọ bụ gafere ASLR. Nke a apụtaghị na ekpughere ụdọ mwakpo ọha na eze nwere ike guzosie ike ma na-emezu iwu zuru ụwa ọnụ. S4
• Rịọ ịgba ọgwụ mgbochi/ ngafe nyocha: Ọ nwere ike gbanwee ọnọdụ azụmaahịa echekwara ozugbo ma ọ bụ rịọ ọdịnaya, enweghị ike ileghara ya anya naanị n’ihi na ọ naghị enweta shei ozugbo.
• achọpụtala mbọ mbuso agha: CVE-2026-42945 na Mee 2026 nwere akụkọ banyere ọrụ nrigbu n’ime ọhịa; ekwesịghị ịkọwa eziokwu a akụkọ ihe mere eme ozugbo na-egosi na ejirila CVE ise niile dị na Ọktoba nke ọma n’ọtụtụ buru ibu. S23

3. Ndozi ụdị na nhọrọ patch

3.1 NGINX Open Source akara nkwado ndabere na mpaghara

alaka elu ugwu	Versiondị gọọmentị izizi na-ekpuchi adịghị ike ise na Ọktọba	Nkwanye dị ka nke 2026-10-27
Stable 1.30.x	1.30.6（2026-10-14）	Wụnye opekata mpe 1.30.6, wee soro ụdị nchekwa na-esote.
Mainline 1.31.x	1.31.7（2026-10-14）	1.31.8（2026-10-21）
Alaka NGINX Open Source mbụ	Enweghị ike ikpe ya ikpe naanị na “etinyere patches adịghị ike ochie”	buru uzọ kwaga n’alaka ahu edoziworo; ma ọ bụghị ya, a chọrọ onye na-ere ahịa ka ọ nye ihe akaebe nke nkwado na ndabere CVE-by-CVE.

Ndị a bụ nkwubi okwu nke koodu isi mmalite nginx.org na ngalaba ọrụ, na ekwesighi iji ya gọnarị ngwungwu nchekwa ozugbo yana ndozi azụ azụ nke onye na-ere nkesa nyere. Ọbụlagodi na uru 1.31.6 dị ukwuu karịa 1.30.6, ọ ka dị ala karịa ntọala patch nke ngalaba isi. S1S2

3.2 Oke mmetụta dị elu nke CVE ise

Edepụtara oke ndị a dị ka ederede izizi nke akwụkwọ akụkọ nchekwa nginx.org siri dị ma ọ dị mkpa ka aghọta ya na njikọ “alaka na-agba ọsọ ugbu a” yana “ụzọ nhazi n’ezie”:

CVE	Ụdị mkpado ndị dị n’elu emetụtara	Ụdị edozila nke aha ya bụ eze
CVE-2026-15176	0.1.29–1.31.6	1.30.6+ ma ọ bụ 1.31.7+, n’ime alaka ha dị iche iche.
CVE-2026-93479	1.30.0–1.30.5，1.31.2–1.31.6	Otu dị ka n’elu
CVE-2026-97205	0.8.11–1.31.6	Otu dị ka n’elu
CVE-2026-95101	1.25.0–1.31.6	Otu dị ka n’elu
CVE-2026-97629	1.23.2–1.31.6	Otu dị ka n’elu

CVE-2026-93479 nwere oke mmeghe-ụdị; Ọ bụghị ụdị NGINX ochie ọ bụla na-emetụta nlọghachi azụ a. Ụdị ndị ochie na-abụghị oke ndị ahụ ka nwere ike imetụta ya na mbụ map regex vulnerability CVE-2026-42533. S1

3.3 Ubuntu: ọdụ ụgbọ mmiri nkesa (USN-8955-1)

Canonical USN-8955-1 October 26, 2026 na-enye mmelite nchekwa maka anọ Ubuntu na-ewuli: S13

Ụdị Ubuntu	nginx na otu ụdị ngwugwu edoziri	Nkọwa
22.04 LTS	1.18.0-6ubuntu14.22	Ọ bụ onye na-ere azụ azụ; Nọmba ụdị nke elu ka na-egosi 1.18.0
24.04 LTS	1.24.0-2ubuntu7.19	Otu dị ka n’elu
26.04 LTS	1.28.3-2ubuntu1.12	Otu dị ka n’elu
26.10	1.30.4-7ubuntu1.1	Otu dị ka n’elu

Ọkwa a nwere ụdị ngwungwu ihe jikọrọ ọnụ dịka nginx-core, nginx-extras, nginx-full, na nginx-light. Emela nkwubi okwu banyere ma a ga-edozi ya site na akụkụ elu nke naanị nginx -v gosipụtara. dị ka Ubuntu 24.04 na 1.24.0-2ubuntu7.19 bụ onye na-ere ahịa ejirila akwachie ya, mana 1.24.0 sitere na ebe ọ bụla adịghị mma.

Ubuntu n’ihu ọha gosikwara nke ahụ n’ụzọ doro anya CVE-2026-95101 na-emetụta naanị Ubuntu 26.04 / 26.10 , na CVE-2026-97629 na-emetụta naanị Ubuntu 24.04 / 26.04 / 26.10. Nke a bụ Ubuntu Nkwakọ ngwaahịa na oke ọrụ nke onwe ya, nke enweghị ike ịkwalite ozugbo na nkesa ndị ọzọ. S13

3.4 Debian: Ọdịiche dị n’etiti nsụgharị ga-enyocharịrị iche.

Ndụmọdụ Debian DSA-6575-1 (2026-10-21) kpuchiri CVE ise ndị a wee chọpụta ngwungwu nginx edobere maka Debian 13 / trixie dị ka:

1.26.3-3+deb13u10

Agbanyeghị, n’oge nkwenye nke akụkọ a, 1.22.1-9+deb12u10 maka Debian 12 / bookworm ka na-egosi dị ka onye na-ahụ maka nchekwa Debian. Ya mere:

• Debian 13 Naanị melite ma nabata dịka DSA-6575-1 si dị.
• Debian 12 ga-elele ndozi nchekwa nke onye na-ahụ maka nchekwa ugbu a ma ọ bụ onye na-ere ELTS nyere otu otu; tupu ekwenye na ndozi ahụ na ọkwa ahụ, ekwula na ihe ise ahụ niile edoziwo dabere na ihe ịga nke ọma nke apt upgrade.
• Ihe ngwungwu isi Debian nwere ike ibu ihe ngwungwu anọghị na nọmba ụdị nginx.org. Maka iwulite omenala, ịkwesịrị ịlele nhazi ngwungwu koodu isi mmalite zuru oke, ma ị nweghị ike ịdepụta otu nkwa elu ma chee na ọ zuru oke.

Ọdịiche a dị n’elu dabere na ndekọ ndekọ DSA na CVE. S14S15S16

3.5 NGINX Plus, njs na Ingress Controller

Ngwaahịa/ Akụrụngwa	Nhọrọ nchekwa yana isi ihe nyocha
NGINX Plus (ụdị azụmahịa)	Biko rụtụ aka na ntụzịaka ọkwa na nkwalite nke ngalaba Plus dabara na F5. CR kacha ọhụrụ n’oge nkwenye bụ PLS.37.2.0.1, na nchekwa nchekwa nke LTS bụ PLS.37.0.7.1; enweghị ike dochie ụdị gbakwunyere na azụ azụ agụnyere ozugbo site na ọnụ ụzọ 1.30/1.31. S19
njs / ngx_http_js_module	2026-10-14 weputara njs 1.0.2 wee dozie CVE-2026-101019 na CVE-2026-101025; ọ bụrụ na ị na-eji njs, ị ga-elelekwa ndakọrịta nke modul na NGINX. S20
F5 NGINX Onye njikwa mbata / akwa ọnụ ụzọ ámá	Isi NGINX bụ yinye nkesa ngwanrọ nwere njikọ ma nweere onwe ya. Dozie adịghị ike ndị dị mkpa na ndị njikwa ha, onyonyo na ndetu mwepụta ha. Ị nweghị ike dochie ọnụọgụ abụọ NGINX na Pod.
Kubernetes Ogbe kubernetes/ingress-nginx	Akwụsịla ọrụ a na Maachị 2026 ma agaghịkwa enye mmezi nchekwa ọhụrụ. Ị ga-eme atụmatụ ịkwaga na onye njikwa echekwara ma ọ bụ Gateway API kama imehie nọmba ntọhapụ ya maka F5 NGINX Ingress Controller. S21

3.6 Kedu patch ị ga-ahọrọ n’ezie?

Ụdị ntinye	Omume akwadoro	Ihe akaebe nke nrụzi
nginx.org ọrụ DEB/RPM ngwugwu	Kwalite gaa na ụdị nke alaka ụlọ ọrụ dị elu nke edobere	nginx -v/-V, isi iyi ngwugwu, ọkwa nchekwa gọọmentị
Ubuntu/Debian ebe nchekwa ọrụ	Wụnye ngwungwu nchekwa ndị na-ere ahịa	Ụdị ngwugwu zuru oke + onye na-ere USN/DSA + ọkwa CVE
RHEL/Alma/Rocky/SUSE/Nkesa ndị ọzọ	Kwalite dịka akwụkwọ akụkọ nchekwa nkesa na ụdị ngwugwu siri dị	CSAF/nkwuputa onye na-ere ahịa kwekọrọ, enweghị ike itinye ụdị Ubuntu/Debian.
Onyonyo akpa ma ọ bụ ahaziri ahazi	wughachi ma ọ bụ dọpụta onyonyo nrụzi ekwenyesiri ike wee dochie ya n’usoro ntụgharị	Ihe mgbari onyonyo, wuo SBOM, NJ onyonyo pọd/akpa na-agba ọsọ
NGINX chịkọtara onwe ya, OpenResty, Tengine ma ọ bụ ụdị ejiri modul ndị ọzọ mechie.	Mee ka iji ụdị nchekwa zuru oke nke onye na-echekwa ụzọ; rụpụta patch backports maka osisi a na-achọsi ike mgbe ọ dị mkpa	Ndozi adịghị ike ise, ndakọrịta ABI/module, otu na mgbagha azụmaahịa

OpenResty na Tengine bụ usoro ntọhapụ dị iche iche; Tebụl a na-akọwa naanị usoro nkwenye. apụtaghị na a na-emetụta ụdịdị ya niile n’otu oge dịka ọkọlọtọ NGINX, ma ọ bụ enweghị ike itinye patch koodu mgbago na-enweghị ihe ọ bụla.

4. Usoro mmezi nke ọma

4.1 Ndepụta nke ezigbo oge nke ịnweta okporo ụzọ mpụga

Kpọkọtanụ maka ntinye ọ bụla opekata mpe:

• Aha ngalaba, ndozi ibu/CDN/njikọ proxy ihu, ụzọ mkpughe saịtị na usoro netwọk ejiri.
• Ngwaahịa NGINX (Open Source, Plus, Ingress, etc.), ụdị zuru oke, isi iyi ngwungwu, mgbari onyonyo.
• nginx -V na-egosiputa modul ụlọ na nchịkọta mkpokọta; ma enwere njs, Lua, OpenResty, yana modul ike nke ndị ọzọ.
• Ezigbo na-agba ọsọ master/worker PID, Ngalaba Ọrụ/Container/Pod, oyiri na Worker Node.
• Nhazi http/stream, server, location, include dị irè.
• Ma ọ ga-eme ka HTTP/3, mTLS, SSI/AIO, ụzọ ndekọ dị ike, mgbagwoju anya map na njide regex.

Elelela naanị /etc/nginx/nginx.conf ndabara. Ebe mmepụta ihe na-ebukarị ọtụtụ saịtị, TLS na nhazi modul site na include. Enwere ike ịnwe ọtụtụ ụzọ nrụnye NGINX ma ọ bụ ọtụtụ ọkwa proxy.

4.2 Lelee ụdị na ozi nchịkọta

# NGINX 版本及构建选项
nginx -v
nginx -V 2>&1

# Linux：查看实际运行的 NGINX 进程
ps -eo pid,ppid,user,comm,args | grep '[n]ginx'

# Debian / Ubuntu：查看完整已安装包版本、来源
apt-cache policy nginx
# 兼顾 nginx-core / nginx-full / nginx-extras 等实际已安装包
dpkg-query -W 'nginx*' 2>/dev/null

# RPM 系：以实际安装包及仓库公告为准
rpm -qa | grep '^nginx'

nginx -V na-akọ na owuwu nke ọnụọgụ abụọ a chọtara n’okporo ụzọ-iwu; ọ naghị egosi na worker na-agba ọsọ eburula ya. nginx -v nwere ike hapụ ngwungwu ngwungwu nkesa zuru oke, yabụ lelee njikwa ngwugwu ma ọ bụ ndekọ ndekọ ọkọnọ.

4.3 Mbupụ nhazi dị irè ma mee agba nke mbụ nke nyocha static

nginx -T ga-anwale nhazi ahụ wee tụfuo nhazi ahụ jikọtara ọnụ. Mwepụta ahụ nwere ike ịnwe ozi dị nro dị ka nzere nyocha, ụzọ igodo, aha nnabata ime, wdg. A na-atụ aro ka ịchekwaa ọdụ ọdụ ahụ na ikike root yana ikike faịlụ nkeonwe, ma etinyela faịlụ mbụ na iwu ọrụ ọha:

sudo sh -c 'umask 077; nginx -T > /root/nginx-effective.conf 2> /root/nginx-config-check.log'

sudo grep -nE \
  'alias|rewrite|map[[:space:]]|request_filename|aio[[:space:]]|ssi[[:space:]]|quic|http3|proxy_request_buffering|ssl_session_cache|ssl_session_ticket_key|ssl_session_tickets|ssl_verify_client|log_format|root[[:space:]]' \
  /root/nginx-effective.conf

Nke a bụ naanị onye na-achọ ụzọ ndoro-ndoro anya, ọ bụghị ngwa nyocha akpaaka CVE a pụrụ ịdabere na ya:

1. grep enweghị ike ikpebi ma mgbanwe ndị ahụ dị n’otu location ma ọ bụ otu agbụ nyocha arịrịọ, ma ọ bụ enweghị ike wepụta mmekọrịta nhazi ihe nketa.
2. proxy_request_buffering on, ụfọdụ cache na nhazi tiketi nwere ụkpụrụ ndabara, na ideghị ntuziaka kwekọrọ apụtaghị na ihe ize ndụ ahụ ga-apụ n’anya.
3. Nhazi nke ndị proxies reverse, CDN, akpa akụkụ, ma ọ bụ ndị njikwa emebere nwere ike ịdị iche na faịlụ ejiri aka nyocha.
4. Njirimara nke NGINX Plus na modul siri ike nwere ike ịdị mkpa ka akwado ya site na iji ngwaọrụ njikwa ọrụ nke ha.

4.4 Bugharịa ndozi site na ọwa ntụkwasị obi

Debian/Ubuntu (ebe nchekwa nkesa ọrụ):

sudo apt-get update
apt-cache policy nginx

# 升级发行版仓库中已经安装的 NGINX 及相关包；
# 先确认 Candidate 属于修复版本，再执行升级。
sudo apt-get install --only-upgrade nginx

# 对实际安装的 nginx-core / nginx-full / nginx-extras 等包
# 确认它们的版本和依赖一同达到厂商修复要求。
dpkg-query -W 'nginx*' 2>/dev/null

Usoro iwu a enweghị ike iwepụta ndozi nchekwa site na ikuku dị gịrịgịrị na-adibeghị. Karịsịa maka Debian 12, ọ bụrụ na ngwungwu kwalitere ka na-ahụta na ọ bụ ihe na-adịghị ike site na sistemụ nleba anya, nrụzi ndị ọzọ na-ere ahịa, ikewapụ ma ọ bụ usoro mbugharị chọrọ. S13S14S15

nginx.org ngwugwu ọrụ:

# 先确认仓库来自 nginx.org、目标分支和候选版本
apt-cache policy nginx
# 经变更审批后再执行对应仓库的升级命令
sudo apt-get install --only-upgrade nginx

Ọ bụrụ na ị na-eji onwe achịkọtara, OpenResty, Tengine ma ọ bụ NGINX Plus, jiri ụdị ndozi nke onye na-akwado ya kwekọrọ na-akwado ma ghara ịgwakọta nginx.org, nkesa na ngwugwu nchekwa ndị ọzọ. Ekwesịrị idowe ọnụọgụ abụọ/oyiyi izizi, mbinye aka, na ngosipụta mbugharị mbugharị.

arịa/Kubernetes: melite onyonyo a na-apụghị ịgbanwe agbanwe, dekọọ mgbari ya wee jiri ntugharị emebere dochie ihe ochie niile. kubectl rollout status na-akwado naanị na onye na-ahụ maka nnyefe agwụla; chọpụtakwa ihe mgbari onyonyo, ụzọ mbata na oyiri adịghị mma.

4.5 Nyochaa nhazi ma dochie ochie Worker

sudo nginx -t
# 按服务实际名称、主机高可用和变更窗口执行重启
sudo systemctl restart nginx
sudo systemctl status nginx --no-pager

# 核查真正存在的 master / worker
ps -eo pid,ppid,user,comm,args | grep '[n]ginx'

Emela nginx -s reload dị ka ihe akaebe na ọnụọgụ abụọ na-agba ọsọ: nhazigharị nhazi nkịtị ka master ochie malite ndị ọrụ ọhụrụ na-enweghị dochie ya. NGINX na-akwado usoro nkwalite ọnụọgụ abụọ dị n’ịntanetị raara onwe ya nye, mana ọ chọrọ usoro na nkwenye ndị ọzọ. Na-enweghị usoro guzosiri ike, jiri ngbanwe okporo ụzọ dị elu nke ọrụ malitegharịa, ma ọ bụ bugharịa arịa nọchiri anya. S22

Ọ bụrụ na ị jikwaa NGINX site na oghere systemd, edemede ntinye akpa, ma ọ bụ ọtụtụ nrụnye, ị ga-elele ebumnuche mmalite na ụzọ nhazi kama iche na systemctl restart nginx na-ekpuchi ọnọdụ niile.

4.6 Nabata ma mee nlọghachi azụ azụ azụ site na ezigbo ọnụ ụzọ mpụta

A na-atụ aro ka ịrụ opekata mpe:

• Hụ HTTPS nkịtị, ụzọ edegharịrị, akụrụngwa kwụ ọtọ na ibe eserese alias ziri ezi.
• Nkesa map na-adị mgbe niile, ụzọ root na-agbanwe agbanwe, ụzọ ntinye akwụkwọ, ụzọ SNI/akwụkwọ ntinye akwụkwọ, yana Stream proxy ziri ezi.
• Bụ mbulite nkịtị, nbudata chunked, arịrịọ API yana oke oke olu maka HTTP/3 (mgbe enyere ya) ka dị ka a tụrụ anya ya.
• mTLS: Arịrịọ asambodo ziri ezi kwesịrị ịga nke ọma; Asambodo efu, kubie ume, ma ọ bụ enweghị ikike ka a ka ga-ajụ, na ịmaliteghachi/njikọ TLS ekwesịghị ịgbanwe ikike na mberede.
• Ma ibe SSI na ịnweta faịlụ asynchronous bụ ihe nkịtị; ndekọ njehie ahụ egosighi arịrịọ na-ezighi ezi maka ntụnyere ebe nchekwa ma ọ bụ mkpọka Worker ugboro ugboro.
• Mgbe mgbanwe okporo ụzọ gasịrị, usoro ụdị ochie na oyiri oyiyi ochie kwesịrị ịpụ.

Ekwesịrị ịme ule na mpaghara nke aka ya ma ọ bụ ikike. Nnwale anwụrụ ọkụ nke arịrịọ nkịtị enweghị ike igosipụta na echekwala adịghị ike ebe nchekwa; N’ikpeazụ, a ga-ejikọtarịrị nabata ụdị nke ndị na-ebubata ngwaahịa, patch koodu isi iyi na ule oge ịgba ọsọ maka nnabata.

5. Mbelata usoro mgbe nkwalite ngwa ngwa agaghị ekwe omume

Nkebi a bụ nhọrọ mbelata ihe egwu, ọ bụghị ndochi patch. Ekwesịrị ịkwado mgbanwe nhazi oge niile, mebie nginx -t, wepụta ya na batches, wee tụgharịa ngwa ngwa ma ọ bụrụ na ọ dị mkpa. S3S4

5.1 njikwa okporo ụzọ dị mkpa dabere na mkpughe mpụga

Mee ka ụzọ mbenata elu ọgụ nke ọrụ enweghị ike ịkwalite n’oge: n’elu njikwa na ime API Tinye njikwa ịnweta isi mmalite ntụkwasị obi, ikewapụ netwọk elu ma ọ bụ na-anọghị n’ịntanetị dị mkpụmkpụ; tinye njikọ, rịọ ahụ na oke ọnụego na ọnụ ụzọ ndị nwere nnukwu ihe ize ndụ; hụ na nyocha isi mmalite na-apụta na ntinye metụtara NGINX tupu agbụ nhazi arịrịọ. Ekwesiri iburu n’uche na ọtụtụ n’ime adịghị ike n’onwe ha dị na NGINX N’ime ụgbọ elu data, omenala WAF Iwu nwere ike ọ gaghị ekpebi n’ụzọ ziri ezi nhazi nhazi nhazi ọnọdụ.

5.2 alias / rewrite: zere ịtụle $request_filename mgbe idegharịchara

A na-atụ aro ka ịlele na mezie:

• Gbalịa ka ị ghara ime rewrite nke ga-agbanwe URI n’otu oge ka location jiri alias.
• Zere iji $request_filename mgbe edegharịrị URI mana emechabeghị egwuregwu ọnọdụ ziri ezi.
• Lelee nrụtụ aka ndị na-agbanwe agbanwe na-apụtaghị ìhè na return, set, if, add_header, nweta usoro ndekọ, ma tinye faịlụ.
• Jiri root/try_files/location nke kwụụrụ onwe ya mgbe azụmahịa nyere ikike, mana ọ na-agbanwe naanị alias gaa root. Ọ nwekwara ike ịgbanwe semantics ụzọ faịlụ, nke a ga-enyocharịrị otu otu.

Edeghachila ozugbo “ntụgharị ederede echekwara” na ịntanetị iji degharịa nhazi dị adị. Prefixes location dị iche iche na idegharị lekwasịrị anya na-ebute ụzọ n’ụzọ nwere nkọwa dị iche iche. S5

5.3 map/Regex: Belata ngwakọta steeti na-agbanwe agbanwe.

A na-atụ aro ka ibu ụzọ weghara ndị akpọrọ aha wee kpachie oke mgbasa ha, kama ikwe ka ejigharị ihe ndị na-amaghị aha dịka $1 gafee ụzọ nyocha regex dị iche iche ka oge na-aga. Dịka ọmụmaatụ:

# 演示具名捕获的结构，实际变量名和匹配表达式须按业务调整
map $host $tenant_root {
    default /srv/www/default;
    ~^(?<tenant>[a-z0-9-]+)\.example\.net$ /srv/www/$tenant;
}

Mpempe akwụkwọ a na-egosipụta naanị usoro dị mfe nyocha nke nwe mgbanwe; apụtaghị na egosipụtara na ọ ga-ewepụ onwe ya kpamkpam CVE-2026-93479 ụzọ na-akpalite. Karịsịa, nyochaa ma ọ bụ root ndị ọzọ ma ọ bụ log_format na-ezo aka n’ụdị mgbanwe njide tupu oge eruo, yana ma enwere volatile, ụzọ dị ike, na ụdọ nyocha na-adabere na ya. F5/CERT na-atụ aro iji njide aha ya na ịmachi oke ojiji na nhazi ndakọrịta oge niile dị ka enyemaka obere oge. S3S6

5.4 AIO + SSI: Mechie nchikota ọrụ na-adịghị mkpa

Maka sava/ụzọ na-achọghị SSI ma ọ bụ faịlụ asynchronous I/O, jiri:

# 在适当的 http/server/location 上下文中配置
ssi off;
aio off;

Site n’echiche nke adịghị ike na-akpalite ọnọdụ, imechi otu n’ime ha abụọ na-emekarị iji wepụ ihe a kapịrị ọnụ a kọwara; mmechi n’otu oge bụ naanị na ọdabara ọnọdụ ebe azụmahịa anaghị adabere na nke a ike. Lelee include virtual, arịrịọ sub, cache, na omume ọdọ mmiri eri; mgbe ibu proxy dị elu, imechi AIO nwere ike ịgbanwe latency na arụmọrụ I/O. S7

5.5 HTTP/3 Rịọ injection ahụ: mechie ọnụ ụzọ nwa oge ma ọ dị mkpa

Gbanyụọ ya quic onye na-ege ntị gụnyere HTTP/3 , kagbuo nke Alt-Svc nkụnye eji isi mee nke na-ekwupụta HTTP/3 , wee lelee ma akụkụ oyi akwa/load balancer ka na-eziga QUIC na-arịọ ndị na-emezigharịghị ozugbo NGINX :

# 示意：保留 HTTPS/TCP；暂时移除此前的 QUIC/UDP listen
server {
    listen 443 ssl;  # 保留 HTTPS/TCP 入口
    # 对支持新版语法的构建，可在此使用 http2 on;
    # 删除原有的 listen 443 quic reuseport;
    # 删除原有的 add_header Alt-Svc ...;（仅限宣传 h3 的那项）
    # 其余证书、server_name、location 等配置保持不变
}

Nke a dị n’elu bụ naanị nkọwa nke mgbanwe mgbanwe, ọ bụghị nhazi ihe nkesa zuru oke nke nwere ike ime n’otu n’otu. Ngwakọta ntọala nke HTTP/2 metụtara ụdị NGINX; Ọ bụrụ na ịchọrọ idowe HTTP/2, ị ga-eji http2 on; ma ọ bụ syntax dị adị dị ka ụdị kwekọrọ, wee lelee nginx -t. ga-ejikọta ya na nhazi ihe nkesa dị adị tupu ebunye ya, kama iji akụkụ a dochie akụkụ ahụ dum. na-enyochakwa UDP 443 firewall, ebe nkwụsị HTTP/3 na ụzọ ọdịda ndị ahịa nke CDN/proxy n’ihu.

Ụdị ọzọ nke mbelata oge dị mkpirikpi bụ iji proxy_request_buffering off; na emetụta proxy ụzọ, ma nke a ga-agbanwe omume nke upstream arịrịọ ahu gụgharia, ọdịda retries, na ụfọdụ bulite workflows; a ga-eji naanị mgbe nnwale zuru oke na nkwenye na ntuziaka ahụ emetụtara ụzọ proxy HTTP/3 emetụtara. S8S18

5.6 TLS Tiketi nnọkọ: Nchedo izizi mTLS oke nyocha

Ọ bụrụ na nkwalite agaghị ekwe omume yana ihe atụ dabere na cache nkekọrịta oge + ntụgharị igodo tiketi akpaka, nyochaa:

# 在 nginx http/server 适当作用域进行配置
ssl_session_tickets off;

Nke a nwere ike gbanyụọ usoro tiketi nnọkọ TLS, si otú ahụ wepụ ụzọ adịgboroja tiketi akọwapụtara na adịghị ike a; agbanyeghị, ọ nwere ike imetụta arụmọrụ mmalite nke oge. Ịnweghị ike gbanyụọ nkwenye ndị ahịa mTLS iji “zere adịghị ike”, n’ihi na nke ahụ ga-ehichapụ ókèala mbụ ahụ ozugbo. S9S12

Faịlụ ssl_session_ticket_key doro anya yana ntụgharị echekwara echekwabara nwekwara ike iji usoro njikwa TLS ọkachamara wee gafere ọnọdụ ewepụtara akpaaka, mana njide isi, nkesa ọnụ zuru oke, ntụgharị na ogologo ndụ tiketi ochie ga-enyocha nke ọma. A naghị atụ aro ka ị tinye igodo nwere ike ịmegharị ogologo oge na nhazi weebụ ma ọ bụ edemede maka ihe mberede nwa oge. A ga-enyochakwa ọrụ dị oke mkpa nke na-eji mTLS maka omume mweghachi nke oge TLS yana ịjụ arịrịọ na-enweghị ezigbo asambodo ndị ahịa. S12

5.7 Ọrụ nke sistemụ arụmọrụ yana nchedo oke

# Linux：常见值 2 表示进程地址空间随机化处于完整启用状态
sysctl kernel.randomize_va_space

ASLR, ndị ọrụ na-abụghị root, sistemụ faịlụ akpa ndị na-agụ naanị, ikike faịlụ pere mpe na ikewapụ netwọkụ nwere ike ibelata mmetụta RCE nwere ike. ASLR anaghị edozi oke oke oke ma ọ bụ UAF na enweghị ike ikwe nkwa na ndị ọrụ agaghị ada. WAF, oke ọnụego na ịrịọ oke nha ahụ anaghị edozi njikọ igodo tiketi TLS. S4

5.8 nghọtahie nkịtị: Ọrụ ndị a ezughi oke iji mechaa nrụzi ahụ

Arụ ọrụ nkịtị	Gịnị kpatara na o zughị ezu?
“nginx -v dị ọhụrụ”	Alaka nke ọ nwere, ụdị ngwungwu azụghachi azụ zuru oke nke ụdị ntọhapụ yana usoro ịntanetị anaghị enyocha ya.
”Ọ bụ naanị otu n’ime intranet ka emelitere”	Ochie Worker/ akpa ochie/ochie CDN mmalite ka na-anata arịrịọ
”Saịtị anaghị eji PHP/dynamic mkpado”	Nrụrụ ahụ na-apụta na isi ụzọ NGINX ma ọ bụ nyocha protocol na adabereghị na mkpochapụ PHP.
”Imepe WAF/Cloudflare ezuola”	Enweghị ike ịnwapụta WAF iji gbochie ntụpọ ebe nchekwa dabere na NGINX ma ọ bụ ntụpọ mmalite TLS
”Emeghela ASLR”	Naanị iji ohere nke mbelata ihe isi ike; DoS nwere ntụtụ arịrịọ ka ga-ekwe omume
”HTTP/3 adịghị ekpughe na netwọk ọha na eze, yabụ na ọ dịghị mkpa ịkwalite ma ọlị”	CVE anọ ndị ọzọ ka na-achọ nyocha nke onwe; ma enwere ike inwe njikọ kpọmkwem na mmalite zoro ezo
”Edozie adịghị ike nke July map”	Ọktoba CVE-2026-93479 gụnyere okwu nleba anya edemede na-esote
”Ịkwụsị caching na-edozi nsogbu niile”	Naanị emetụta ụfọdụ TLS cache ma ọ bụ AIO ndapụta, na ọ dịghị ekpuchi utu aha, script, HTTP/3

6. Official Patch mmejuputa echiche na nyochaa isi

Akụkụ a na-esochi ndozi NGINX nke October 2026. Mpempe akwụkwọ ndị ahụ na-egosi mgbanwe nnochite anya maka nlebanya patch; ha ezughị ezu, ndozi na-achịkọta onwe ya. Maka iwulite omenala, nyochaa mmemme zuru oke, koodu gbara ya gburugburu na ule, wee họrọ ntọhapụ akwadoro zuru oke. S5S6S7S8S9

Edegharịrị 6.1 CVE-2026-15176: URI ka edegharịrị ka ọ gụnyere ọnọdụ njụta nkewa ụzọ alias

Ihe mgbago elu emeziri ngx_http_map_uri_to_path() na src/http/ngx_http_core_module.c:

- if (alias && !r->valid_location) {
+ if (alias && (!r->valid_location || r->uri_changed)) {

lekwasịrị anya nleba anya: Enweghị ike ịga n’ihu na-agbakọ usoro faịlụ faịlụ mgbe URI agbanweela mana ọnụọgụ ọnọdụ nke alias enweghịzi ntụkwasị obi. Nke a bụ nkwalite mmachi tupu steeti. Ọ bụghị nlele dị mfe ma arịrịọ URI nwere mkpụrụedemede iwu na-akwadoghị. S5

6.2 CVE-2026-93479: Kpebie ọdịiche dị n’etiti ogologo data mmepụta na ogologo echekwara

Mgbago elu na-emelite src/http/ngx_http_script.c na src/stream/ngx_stream_script.c n’otu oge. Enwere ike ichikota isi ebumnuche dika:

- n = len;
+ n = 0;
  /* ...计算实际脚本输出长度... */
- value->len = n;
- value->data = ngx_pnalloc(pool, n);
+ value->len = n + len;
+ value->data = ngx_pnalloc(pool, n + len);

N’ebe a, pool bụ ihe atụ aha oke: n’ezie HTTP na Stream nkenye okwu dị iche. Mgbanwe a na-ebu ụzọ gbakọọ ogologo mmepụta edemede, wee gbakwunye ogologo echekwabara na oke ikpeazụ ka mmepụta ghara idegharị oghere echekwara. S6

Mgbe ị na-enyocha ma na-atụgharị azụ, onye nyocha HTTP/Stream ga-ekpuchirịrị; naanị ịlele faịlụ syntax nhazi nke map enweghị ike igosipụta na edozila ntụpọ ahụ.

6.3 CVE-2026-97205: Tọọ ebe nchekwa maka ọnụ ọrụ asynchronous 8-bit

Agbakwunyere elu na src/http/ngx_http_request.h:

#define NGX_HTTP_MAX_BLOCKED 250

Ma tinye ntinye yiri ya na ọgụgụ faịlụ asynchronous, ichere cache, nzacha mmepụta na ọrụ eri:

if (r->main->blocked >= NGX_HTTP_MAX_BLOCKED) {
    /* 使用同步路径，或者拒绝新的异步操作 */
}

lekwasịrị anya nyocha: Ụzọ koodu niile ga-agbakwunye r->main->blocked ga-ekpuchirịrị. Ịnweghị ike dee ọnụ ụzọ mgbe niile na faịlụ nkụnye eji isi mee. Backport chọkwara ịlele nchikota zuru oke nke ndaghachi azụ mmekọrịta, nzaghachi asynchronous na nloghachi mperi iji hụ na mkpọchi ọnwụ ma ọ bụ ntanye ntụaka agaghị ebute site na ịjụ ọrụ ozugbo. S7

6.4 CVE-2026-95101: Jikwaa ọkwa skip iche maka okpokolo agba amabeghị.

Mgbago elu na-agbakwunye ogige skip na nhazi ọkwa nke HTTP/3 ma na-eme nkewa ọkwa:

if (st->type != NGX_HTTP_V3_FRAME_DATA && st->length > 0) {
    st->skip = st->length;
    st->length = 0;
    st->state = sw_skip;
}
/* ... */
rc = ngx_http_v3_parse_skip(b, &st->skip);

Isi ihe abụghị “ịgbanyụọ okpokolo agba HTTP/3 amaghị ama”, mana iji hụ na n’ofe ọtụtụ agụ, ọnụ ọgụgụ byte ndị awụsara na ogologo ụgwọ ọrụ DATA bụ ndị steeti nọọrọ onwe ha na-achịkwa mgbe niile. Nlebanya kwesịrị ilekwasị anya na Sharding cross-buffer frame amaghi ama, yana ngbanwe nke client_max_body_size. S8

6.5 CVE-2026-97629: Mekọrịta usoro oghere igodo TLS zuru ezu.

Mgbanwe ndị dị n’elu dị na src/event/ngx_event_openssl.c:

  ngx_memcpy(keys->elts, cache->ticket_keys,
-            2 * sizeof(ngx_ssl_ticket_key_t));
+            keys->nelts * sizeof(ngx_ssl_ticket_key_t));

Onyonyo izizi nwere oghere igodo atọ, mana naanị abụọ mbụ ka e depụtaghachiri. Kama, mekọrịta ya dabere na ọnụ ọgụgụ ihe dị n’usoro iji hụ na usoro igodo ịtụ vootu nke Worker dabara na ebe nchekwa nkekọrịta. Mgbe ị na-enyocha, gosikwa na oke n’usoro, mmalite, mkpọchi mkpọchi na mgbagha na-agbanwe agbanwe, kama ịlele mgbanwe ogologo memcpy otu ugboro. S9

6.6 Gịnị kpatara na anaghị atụ aro ka itinye naanị mperi gbasasịrị agbasasị?

Mgbanwe ise ndị a gbasara src/http, src/stream, src/http/v3, na src/event n’otu n’otu, na ụdị ochie nwere ike ịnwe nchekwa azụ na ndọtị na-akwadoghị. Ntugharị azụ kwesịrị ịmepụta matriks nlele ndị a:

Lelee ihe	Ihe a ga-ekwenyerịrị
isi iyi	Nrubeisi nke gọọmentị, ụdị ebumnuche dabara, patch zuru oke na nkwenye mbinye aka
Ntọala patch izizi	Anaghị emegide mgbanwe akụkọ ihe mere eme dịka CVE-2026-42533, nkesa azụ azụ, wdg.
ụzọ koodu	HTTP + Stream script, AIO/eriri, HTTP/3, OpenSSL Tiketi ekpuchirila.
Ejikọtara dakọtara	OpenSSL, PCRE, modul ABI, modul ike na ndabere njikọ na-agbanwe agbanwe.
arụ ọrụ ndọghachi azụ	alias degharịa, ndekọ ike, SSI/AIO, HTTP/3 bulite, mTLS mmalite mmalite.
oge ojiri gaa	Worker/Pods niile na-arụ ụlọ ọhụrụ enwetara nke ọma, ọ nweghị ihe oyiyi ọ bụla fọdụrụ

Maka otu ndị na-ejigide mwepụta nke ha, a na-atụ aro ka idobe ID patch, ụdị ngwugwu, wuo ndekọ, na akụkọ nkwụghachi azụ maka CVE ọ bụla; maka ịrụ ọrụ na nrụzi nkịtị, ihe ngwọta kachasị mma bụ ịwụnye mmelite nchekwa zuru oke nke onye na-ere ahịa.

7. Ihe ọghọm akụkọ ihe mere eme azụ azụ, alaka ochie na ngwaahịa ndị ọzọ

7.1 NGINX isi adịghị ike kwesịrị nkwenye n’otu oge site na Mee ruo Septemba 2026

Ọtụtụ NGINX nke emelitebeghị ogologo oge abụghị naanị okwu ọhụrụ na-emetụta na Ọktọba. Ndị a bụ ọnụ ọnụ nrụzi ndị nnọchite anya n’ọdịnihu dị nso: S1S2

CVE	Mwepụta mbụ idozi	Ihe egwu dị mkpa na ọnọdụ chọrọ nyocha
CVE-2026-42945	Stable 1.30.1 / Mainline 1.31.0, Mee 13	rewrite Anonymous regex njide na mgbagha nnọchi na-akpalite oke oke, nwere ike RCE; enwere akụkọ ọhaneze maka mbọ mwakpo n’ime ọhịa
CVE-2026-9256	Stable 1.30.2 / Mainline 1.31.1, Mee 22	Mkpokọta regex na nleba anya ogologo na rewrite na-eduga na njupụta.
CVE-2026-42055	Stable 1.30.3 / Mainline 1.31.2, Juun 17	HTTP/2 Nhazi akọwapụtara maka elu ma ọ bụ gRPC, nnukwu ọnọdụ nkụnye eji isi mee na-akpalite oke oke.
CVE-2026-42530	Mainline 1.31.2, Juun 17	HTTP/3 Jiri-N’efu; akara ngosi emetụtara nso 1.31.0–1.31.1
CVE-2026-42533	Stable 1.30.4 / Mainline 1.31.3, Julaị 15	map + regex njide ntule mgbanwe na-ebute oke oke oke, na patches sochirinụ nwere njikọ regression na CVE-2026-93479 na Ọktọba.
CVE-2026-60005	Stable 1.30.4 / Mainline 1.31.3, Julaị 15	ngx_http_slice_module ọdịnaya ebe nchekwa gbapụrụ n’okpuru ọnọdụ mgbanwe dị iche iche yana mmelite cache
CVE-2026-56434	Stable 1.30.4 / Mainline 1.31.3, Julaị 15	SSI metụtara UAF; Ọ bụghị otu root kpatara dị ka October’s AIO agụta adịghị ike.
CVE-2026-90439	Stable 1.30.5 / Mainline 1.31.6, Septemba 15	Oke oke oke oke nke HTTP/3 + kpọmkwem ụdị ụdị OpenSSL, gosipụtara nke ọma dị ka nrụrụ aka nke mkpọka/oke ebe nchekwa.

A ga-enyochakwa adịghị ike ndị ọzọ dị ka NGINX Core, HTTP/2, charset, na SMTP ekwuputara na 2026 dịka akwụkwọ akụkọ nchekwa gọọmentị siri kwuo; Tebụlụ a kpachaara anya lekwasị anya n’ihe omume ndị kachasị mkpa na nke ugbu a NGINX ihu ọha na-eche ihu proxy deployments ma nwee nchekwa ebe nchekwa ma ọ bụ rịọ mmetụta iguzosi ike n’ezi ihe. abụghị CVE niile na 2026. Ndepụta. S1

Kedu ihe kpatara ị ga-eji lebara CVE-2026-42945 anya pụrụ iche

Enwere akwụkwọ akụkọ nchekwa sitere na ụlọ ọrụ gọọmentị na-edekọ ihe omume irigbu n’ime ọhịa yana ozi koodu nrigbu ọha maka adịghị ike rewrite a na Mee. Ya mere, n’ihi na ihe atụ na-adịghị patched ogologo oge site na May ruo ugbu a na-emeghe mgbagwoju mgbe okwu rewrite na ọha netwọk, na mgbakwunye na-emecha mmezi, na-adịghị ahụkebe Worker mkpọku, ohere ndekọ na-enyo enyo mgbanwe n’oge ahụ kwesịrị ọzọ enyocha. S23

“Mgbalị mbuso agha mere” anaghị egosi ozugbo na onye mwakpo ahụ ejirila ntụkwasị obi mee iwu na ebumnuche ọ bụla; mgbe ọ metụtara nzaghachi ihe merenụ, ekwesịrị inyocha ihe nrịba ama nbibi na mkpọka usoro dị iche iche site na ezigbo ihe akaebe nke mmụba ma ọ bụ nnọgidesi ike.

Ndozi 7.2 maka ụdị ochie na nkesa azụ azụ

NGINX Alaka dị iche iche nwere usoro nkwado nke ha yana oge mmeghe adịghị ike dị iche iche. Enweghị ike ịfesa patches ise ọhụrụ ahụ n’osisi ndị mbụ na-enweghị nyocha.

ọnọdụ	Atụmatụ akwadoro
Ụdị mwepụta ekwupụtala patches nche zuru oke	Jiri ngwungwu ndị na-ere ahịa wee detuo ụdị ngwugwu zuru oke; zere iji ọnụọgụ abụọ efu na-adabaghị adaba dochie anya
Debian 12 na mwepụta ndị ọzọ metụtara nke CVE niile na-ekpuchibeghị na ogbe a.	Nyefee iwu ọrụ ihe egwu, kpachie mkpughe mpụga, wee lelee ọkwa ndị na-eweta ngwaahịa/ELTS; kwaga mba ọzọ ma ọ bụ jiri ụdọ ntọhapụ arụkwaghị ekwenye mgbe ọ dị mkpa
Alaka akụkọ ihe mere eme kwụsịrị nkwado mgbago elu	Dozie mbugharị na ụdị akwadoro ụzọ; ọ bụrụ na ọ dị mkpa n’azụ obere oge, ndị na-elekọta ga-enyocha ihe ndabere na ndakọrịta, wee dee ule zuru oke.
Na-abịa na ndụdụ NGINX (OpenResty, Tengine, ọnụ ụzọ ahaziri ahazi)	Buru ụzọ chọpụta ma etinyere ụzọ koodu kwekọrọ, wee jiri nkwupụta nchekwa onye nchekwa ndụdụ. Ọ nweghị ike ịha nhata ozugbo na ụdị elu.
Ihe nkpuchi nche na-eduga na mgbanwe na ọrụ azụmahịa	Nabata usoro mgbasa ozi akwadoro, ntụgharị okporo ụzọ n’etiti ụdị, yana nhazi nhazi; ọ bụghị ihe kwesịrị ekwesị iweghachi ụdị nke netwọk ọha na-enweghị nkewa.

7.3 mmezi iche maka njs, Ingress na NGINX Core

• njs: Na mgbakwunye na mmemme bụ isi NGINX, ị ga-achọkwa ịlele ụdị nke NGINX Javascript modul n’onwe ya. njs 1.0.2 na-edozi ike ọgwụgwụ ebe nchekwa XML nke Ọktọba 2026 yana okwu nnabata XML nwere njiri mara ihe. Maka mbugharị ejikọtara na nkwenye mbinye aka XML site na iji nginx-saml, ị ga-agụrịrị ntuziaka njs gọọmentị maka ihe ndapụta nkwụnye. S20
• F5 NGINX Plus / NGINX Ingress Controller: Plus, njikwa na ọnụ ụzọ ámá Fabric nwere ike onye ọ bụla nwere agbakwunyere akwụkwọ akụkọ nche, ụdị nkwakọ ngwaahịa dị iche iche na adịghị ike amụma pụrụ iche. Ịkwalite otu oyi akwa apụtaghị imelite oyi akwa ọzọ ozugbo. S19
• Kubernetes Community ingress-nginx: Ndị ọrụ Kubernetes ekwupụtalarị na onye njikwa ahụ kwụsịrị ịrụzi ya na Machị 2026, ụlọ nkwakọba ihe ya enweghịkwa mgbagwoju anya na onye njikwa F5. Azụmaahịa emetụtara kwesịrị ịhazi njem dị nro ma nyochaa nkọwa Ingress yana ọdịiche ntụgharị Gateway API kama ichere ụdị nchekwa ọhụrụ. S21

8. Usoro nnabata na nleba anya nleba anya

A na-atụ aro ka ejiri ndepụta ndị a dị ka ọnọdụ nnabata maka mgbanwe iwu ọrụ:

Ihe oru ngo	Ụkpụrụ ntozu	Ihe akaebe enwere ike idowe
Ihe onwunwe na mkpuchi portal	Achọpụtala ihe ngosi niile dị na mpụga na nke nwere ike ịgafe CDN.	Aha ngalaba, LB, IP, Ndekọ pọd/akpa
Ebe ngwugwu na oke nrụzi	Jiri ụdị akwadoro iji kpuchie CVE niile dị	Ndụmọdụ nchekwa dị elu, USN/DSA, ụdị ngwugwu, mgbari onyonyo
usoro ochie na-apụ apụ	All ochie master/worker/container ka edochiela.	PID/oge mmalite, ọkwa mbugharị, onyonyo na-agba ọsọ
Nyocha nhazi	E wepụrụ ma ọ bụ kpuchie nchikota ndị nwere nnukwu ihe ize ndụ, ma enyochala mmekọrịta nketa	hazigharịrị nchịkọta na ndekọ nyocha nke nginx -T
TLS/mTLS	Asambodo ntụkwasị obi gafere; Ajụjụ asambodo ezighi ezi ma ọ bụ na-efu; mweghachi nke oge anaghị agafe nyocha	Nnwale ikike na-adịghị mma/nke ziri ezi, nsonaazụ ule TLS na-achịkwa
HTTP/3 ahụ arịrịọ	Kwado ụzọ edoziri; elu arịrịọ ahu na throttling na-akpa àgwà nke ọma	HTTP/3, bulite proxy, ule mgbagha oke olu
SSI/AIO	Ọrụ ahụ na-emezu ihe achọrọ, Worker enweghị ime ime na-adịghị mma	Mweghachi azụmaahịa, nleba anya ọnụego mkpọka na njehie
Ọrụ na nlekota oru	Ọ nweghị ihe doro anya 5xx, SIGSEGV, usoro na-apụ ugboro ugboro	Ihe ngosi ọrụ na ndekọ tupu na mgbe mgbanwe gasịrị
Atụmatụ nlọghachi azụ	Ọ bụrụ na nlọghachi azụ dị mkpa, buru ụzọ kpachie mkpughe ma chekwaa oke nchekwa	Gbanwee iwu, usoro ihe mberede, yana atụmatụ iche iche
okirikiri ndụ ọzọ	Kpebie ndebanye aha akwụkwọ akụkọ nchekwa, ugboro mmelite akpa, yana atụmatụ mbugharị alaka ụlọ ọrụ	Nweta nkwalite akwụkwọ akụkọ, onye nwere ọrụ na ụbọchị nyocha ọzọ

8.1 Kedu ihe ị ga-elekwasị anya na ndekọ ndekọ na ọkwa ọsọ?

Nchọpụta nsogbu na sava nke ekpughere ogologo oge worker process exited on signal , SIGSEGV , arịrịọ ọdịda spikes, abnormal source access aggregation, na-atụghị anya TLS nnọkọ resumption/authentication azụ azụ omume na abnor omume. Enwere ike iji ihe ngosi ndị a naanị dị ka ihe nleba anya nyocha ma ha abụghị ihe akaebe zuru oke iji gosi ozugbo na erigbula ụfọdụ CVE. ;Enweghị ndekọ dị mkpa adịghị egosi na ọ dịbeghị ọgụ.

8.2 kwadoro okwu mmechi ihe egwu ikpeazụ

Akụkọ nnabata maka gburugburu mmepụta kwesịrị iji okwu ziri ezi na-esonụ:

NGINX Achọpụtala ọnụ ụzọ ọrụ mpụga na ebe ngwugwu ngwanrọ. Ebulila ikpe niile dabara adaba na ụdị nchekwa gọọmentị dị n’elu, ma ọ bụ n’azụ azụta nke onye na-ere ntọhapụ kwadoro; ochie Worker e dochiela arịa ochie. Aha aha/degharịa/map, AIO / SSI , HTTP/3 arịrịọ ahu na TLS Tiketi nnọkọ/ mTLS enyochala nhazi ndị metụtara ya wee gafee arụ ọrụ, nyocha na ịrịọ maka nlegharị anya nkwụsi ike. Maka oge emechabeghị nkwalite ahụ, debanye aha mpaghara mkpughe, usoro nkwụghachi ụgwọ, ndị nwere ọrụ na oge imecha.

Ọ bụrụ na patch maka Debian 12 ma ọ bụ ntọhapụ ndị ọzọ ka ezughị oke, ọ bụghị ihe kwesịrị ekwesị ikpe ụdị nnabata niile dịka “emezuru”; CVE a na-edozighị, ma enwere nhazi ihe na-akpalite kwekọrọ, ọnọdụ dịpụrụ adịpụ na ụzọ nkwalite ikpeazụ kwesịrị ka edekọ nke ọma.

---

Ihe mgbakwunye: isi mmalite na njikọ ndị edepụtara

Nkọwa: Nọmba [Sx] dị na ederede dabara na ngalaba a. Ihe ndị a na-ebute ụzọ maka ọkwa nchekwa ọrụ elu, ntinye koodu, ọkwa mwepụta ndị na-ebubata ya na ozi ụlọ ọrụ nchekwa obodo. A kọwapụtara ịdị njọ nke adịghị ike ndị e hotara dịka njiri mara ọkwa nke nzukọ ọ bụla na-enye; Ụbọchị nkwenye data bụ Ọktoba 27, 2026.

S1 — NGINX Open Source akwụkwọ akụkọ nchekwa gọọmentị

• https://nginx.org/en/security_advisories.html

Nwere ụdị emetụtara n’elu, na-edozi alaka, yana ọkwa dị njọ nke CVE ise Ọktọba, ma kpuchiekwa adịghị ike akụkọ ihe mere eme site na 2026.

S2 — NGINX ndekọ mwepụta gọọmentị

• https://nginx.org/news.html
• https://nginx.org/en/CHANGES-1.30

Kwenye 1.30.6 / 1.31.7 nke 2026-10-14, 1.31.8 nke 2026-10-21, yana nnukwu nchekwa ntọhapụ site na Mee ruo Septemba.

S3 - Cyber ​​Security Agency nke Singapore: F5 NGINX adịghị ike atọ dị egwu.

• https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-150/

Nkọwa nke akara CVSS v4.0 9.2, ọnọdụ nhazi achọrọ, yana ntụnye mbelata nwa oge maka CVE-2026-15176, CVE-2026-93479, na CVE-2026-97205.

S4 - NHS England: F5 NGINX Ndụmọdụ ihe egwu dị elu

• https://digital.nhs.uk/cyber-alerts/2026/cc-4872

Na-akọwa mmetụta DoS / nwere ike RCE nke nsogbu nchekwa nchekwa, yana ihe mgbochi dịka ịgbanyụ ma ọ bụ gafere ASLR.

S5 — Isi mmalite na-eme: CVE-2026-15176

• https://github.com/nginx/nginx/commit/f8a23425bd6840c4c36b4264edf576ba3646156f

Dakọtara na nlele ọkwa nke alias na r->uri_changed na ngx_http_map_uri_to_path().

S6 — isi iyi nke enyere: CVE-2026-93479

• https://github.com/nginx/nginx/commit/6aa4b3fdd4fdc156153f2981eb4070690624447c

Dakọtara na ogologo ederede HTTP/Stream yana mgbagha oke nchekwa echekwara.

S7 - isi mmalite na-eme: CVE-2026-97205

• https://github.com/nginx/nginx/commit/6adfc05ece48f92446383ec1f145446848694698

Dakọtara na ọnụ ụzọ ọnụ ọgụgụ r->main->blocked NGX_HTTP_MAX_BLOCKED 250 yana ụzọ asynchronous ndaghachi azụ.

S8 - isi mmalite na-eme: CVE-2026-95101

• https://github.com/nginx/nginx/commit/1c173a2d8767730e678c27446138d7ae5dd6fd64

Nkewa nke ọkwa dabara na HTTP/3 amaghi ama okpokolo agba fọdụrụ na DATA na-arịọ ogologo ahụ.

S9 — Isi mmalite na-eme: CVE-2026-97629

• https://github.com/nginx/nginx/commit/1916f26e6ca49296568633d309777e36527e5bb2

Dakọtara na oghere igodo niile n’oge mmekọrịta TLS ntụgharị tiketi nnọkọ.

S10 — F5: CVE-2026-15176 Nkwuputa nke onye na-ere ahịa

• https://my.f5.com/manage/s/article/K000162416

Depụta ihe na-akpalite dị ka alias, rewrite, $request_filename na ịnweta ndekọ.

S11 — F5: CVE-2026-93479 ọkwa ọkwa onye na-ere ahịa

• https://my.f5.com/manage/s/article/K000162607

Depụta maapụ regex regex, ụzọ root, yana ọnọdụ nyocha mgbanwe ndekọ.

S12 - NGINX akwụkwọ ikike TLS/SSL akwụkwọ modul

• https://nginx.org/en/docs/http/ngx_http_ssl_module.html

Nkọwa ssl_session_cache, ssl_session_tickets, ssl_session_ticket_key na nyocha akwụkwọ ndị ahịa na ntuziaka ndị ọzọ.

S13 — Ndụmọdụ nchekwa: Ubuntu USN-8955-1 (2026-10-26)

• https://ubuntu.com/security/notices/USN-8955-1

Nye ụdị ngwungwu ngwanrọ zuru oke na oke nkesa nke Ubuntu 22.04 / 24.04 / 26.04 / 26.10.

S14 — Ndụmọdụ nchekwa: Debian DSA-6575-1 (2026-10-21)

• https://lists.debian.org/debian-security-announce/2026/msg00490.html

Kwado ngwungwu ndozi nchekwa 1.26.3-3+deb13u10 maka Debian 13/trixie, wee dekọọ ọgbakọ azụ azụ maka CVE-2026-93479.

S15 — Nleba anya adịghị ike: Debian Security Tracker: CVE-2026-15176

• https://security-tracker.debian.org/tracker/CVE-2026-15176

Eji iji nyochaa ọkwa ndozi nkesa nke Debian 12 / bookworm na Debian 13 / trixie. Ọkwa a nwere ike ịgbanwe site na mmelite nchekwa n’ọdịnihu.

S16 — Nleba anya adịghị ike: Debian Security Tracker: CVE-2026-95101

• https://security-tracker.debian.org/tracker/CVE-2026-95101

Nkwenye mgbakwunye nke ọnọdụ nchekwa nke adịghị ike HTTP/3 na ngalaba Debian dị iche iche.

S17 — Ndụmọdụ nchekwa: Red Hat: CVE-2026-93479

• https://access.redhat.com/security/cve/cve-2026-93479

Nghọta mgbakwunye nke njikọ dị n’etiti adịghị ike nkwụghachi azụ nke Ọktọba yana ndozi maka July CVE-2026-42533.

S18 - NGINX akwụkwọ ikike reverse proxy modul akwụkwọ

• https://nginx.org/en/docs/http/ngx_http_proxy_module.html
• https://nginx.org/en/docs/http/ngx_http_core_module.html

Jụọ ihe ọmụmụ na ụkpụrụ ndabara nke nhazi dịka proxy_request_buffering, client_max_body_size, alias, aio, wdg.

S19 - NGINX Plus ndetu mwepụta gọọmentị

• https://docs.nginx.com/nginx/releases/

List Plus CR/LTS alaka, ụdị, patches na kwalite ndakọrịta ncheta.

S20 — NGINX JavaScript / njs akwụkwọ akụkọ nchekwa gọọmentị

• https://nginx.org/en/docs/njs/security.html
• https://nginx.org/en/docs/njs/changes.html

Nwere Ọktoba 2026 njs 1.0.2 yana nkwado XML metụtara, okwu ike ọgwụgwụ ebe nchekwa.

S21 - Kubernetes: Community ingress-nginx ntụziaka ezumike nka gọọmentị

• https://kubernetes.io/blog/2025/11/11/ingress-nginx-retirement/
• https://kubernetes.io/blog/2026/01/29/ingress-nginx-statement/

Rịba ama na oru ngo ahụ kwụsịrị mwepụta ọhụrụ yana ndozi nchekwa na Machị 2026, a na-atụ aro ka ịkwaga onye njikwa echekwara ma ọ bụ Gateway API.

S22 - NGINX njikwa ọrụ gọọmentị yana ntuziaka nkwalite ọnụọgụ abụọ n’ịntanetị

• https://nginx.org/en/docs/control.html

Chọpụta nbugharị nhazi, malitegharịa na usoro nkwalite faịlụ nwere ike ime n’ịntanetị maka ngbanwe nnabata.

S23 - ọkwa nchekwa gọọmentị: Mee 2026 NGINX degharịa adịghị ike

• https://its.ny.gov/2026-051
• https://www.govcert.gov.hk/en/alerts_detail.php?id=1881

Nye ndabere ihe egwu akụkọ ihe mere eme na ntụnye mmelite nchekwa maka CVE-2026-42945; ikpe ndị metụtara nrigbu n’ime ọhịa kwesịrị ịdabere na ọkwa ụlọ ọrụ n’oge ahụ yana ihe akaebe ọzọ merenụ.

S24 — F5: CVE-2026-95101 na CVE-2026-97629 ọkwa ndị na-ere ahịa

• https://my.f5.com/manage/s/article/K000162613
• https://my.f5.com/manage/s/article/K000162606

Na-ekpuchi ihe egwu dị na arịrịọ HTTP/3 ịrịọ mmịnye ahụ yana ntụgharị igodo tiketi akpaaka TLS n’otu n’otu.

S25 — F5: CVE-2026-97205 Nkwuputa nke onye na-ere ahịa

• https://my.f5.com/manage/s/article/K000162608

Nkọwa SSI/AIO na-ebute ọnọdụ yana ihe egwu nrụrụ ebe nchekwa nwere ike.

NGINX nwelite nche: nlele nhazi, nkwalite na nkwenye