--- title: "NGINX adịghị ike: ihe kpatara, ndozi na nkwenye mmepụta" description: "Nyochaa adịghị ike nke ọnwa Ọktoba 2026 NGINX, ihe nhazi ha chọrọ, ndozi ngalaba akọwapụtara, ọdụ azụ nkesa na nkwenye mmepụta." language: "ig" url: "https://keendigit.com/ig/insights/nginx-remediation-guide" author: "KeenDigit" published: "2026-10-14" updated: "2026-10-27" --- # NGINX adịghị ike: ihe kpatara, ndozi na nkwenye mmepụta Nyochaa adịghị ike nke ọnwa Ọktoba 2026 NGINX, ihe nhazi ha chọrọ, ndozi ngalaba akọwapụtara, ọdụ azụ nkesa na nkwenye mmepụta. Ụbọchị akụkọ akụkọ ihe mere eme: 2026-10-14 (mkpughe na ụbọchị mwepụta nchekwa). enyochara isi mmalite yana agbakwunyere ozi site na 2026-10-27. Edere akụkọ a site na ụbọchị mmemme; mbipute na mmelite ewepụtara mgbe Ọktoba 14 ga-esonye n'okpuru. Ndị na-ege ntị: NGINX Open Source / NGINX Plus webụsaịtị na ntụgharị ọrụ proxy na ndị ọrụ ndozi, ndị ọrụ nzaghachi nchekwa, ndị na-echekwa nkesa, yana ndị injinia na-achịkọta onwe ha NGINX ma na-edobe modul ndị ọzọ. Edemede a lekwasịrị anya na ọghọm isi NGINX ise nke ekpughere ma dozie ya na Ọktoba 14, 2026, ma na-elekwa anya azụ na nchekwa nchekwa nchekwa nnọchite anya wee rịọ adịghị ike iguzosi ike n'ezi ihe site na Mee ruo Septemba 2026. Ọdịnaya ahụ na-ekpuchi ọnọdụ ịkpalite, ọkwa ọkwa koodu, akpata mbelata ọrụ mgbasa ozi, mbelata ọrụ mgbasa ozi, mbelata ọrụ mgbasa ozi. backports ka ochie alaka na mmepụta nkwenye. Ntụtụ aka dị ka [S1](https://keendigit.com/ig/insights/nginx-remediation-guide#source-1) jikọtara na mgbakwunye isi mmalite. A na-eji nhazi ihe atụ naanị iji gosipụta echiche mbugharị na nyocha, ma kwesị ekwesị ka enyocha ya dabere na ụdị n'ezie, ihe nketa nhazi, ndabere, na ikike azụmahịa tupu mmejuputa ya. ## TL;DR: Omume ndị mbụ 1. Welite nkwalite nchekwa ụzọ. Maka nginx.org Mepee ngwugwu isi mmalite, melite Stable 1.30 alaka ka ọ dịkarịa ala 1.30.6 na nke Mainline 1.31 alaka ka ọ dịkarịa ala 1.31.7. N'ụbọchị nkwenye, 1.31.8 bụ ọhụrụ Mainline ntọhapụ. Ndị a bụ ntọala ngalaba dị iche iche; atụla ọnụ ọgụgụ ha n'ofe alaka. [S1](https://keendigit.com/ig/insights/nginx-remediation-guide#source-1) [S2](https://keendigit.com/ig/insights/nginx-remediation-guide#source-2) 2. Nyochaa nrụnye nkesa site na ụdị ngwugwu zuru ezu. Ubuntu 22.04 / 24.04 / 26.04 / 26.10 nwere ndị na-ere ahịa azụ azụ; Debian 13 (trixie) chọrọ opekata mpe `1.26.3-3+deb13u10`. Na nkwenye, ngwugwu Debian 12 (bookworm) `1.22.1-9+deb12u10` ka na-emetụta ya. Lelee CVE nke ọ bụla; Ndụmọdụ Debian 13 egosighi na edobere Debian 12. [S13](https://keendigit.com/ig/insights/nginx-remediation-guide#source-13)[S14](https://keendigit.com/ig/insights/nginx-remediation-guide#source-14)[S15](https://keendigit.com/ig/insights/nginx-remediation-guide#source-15) 3. Nyochaa ngwakọta nhazi ise: `alias + rewrite + $request_filename` , `map` + nyocha regex + mgbanwe, `aio + ssi + include virtual` , HTTP/3 ya na `proxy_request_buffering on` , na `ssl_session_cache shared:...` na akpaka TLS Ntụgharị igodo tiketi nnọkọ. Ọnụnọ nke ntuziaka naanị anaghị ewepụta nrigbu; nyochaa ụzọ arịrịọ na oke nhazi. [S1](https://keendigit.com/ig/insights/nginx-remediation-guide#source-1) [S3](https://keendigit.com/ig/insights/nginx-remediation-guide#source-3) [S4](https://keendigit.com/ig/insights/nginx-remediation-guide#source-4) 4. Dochie usoro ochie na arịa niile. Gbaa `nginx -t`, wee malitegharịa ọrụ ahụ ma ọ bụ rụọ ọrụ mbugharị nnweta dị elu. Kwenye na usoro master/worker ochie apụọla; `nginx -s reload` naanị egosighi na ọnụọgụ abụọ na-agba ọsọ agbanweela. 5. Nyochaa n'ezie njedebe njedebe: HTTP/1.1, HTTP/2, HTTP/3 ma ọ bụrụ na enyere ya aka, bulite proxied na API ozu arịrịọ, mTLS nzere asambodo, SSI ibe. Dekọọ njirimara ngwugwu, ụdị, mgbari onyonyo, usoro na-agba ọsọ na nsonaazụ maka njedebe njedebe ọ bụla. 6. Ọ bụrụ na nkwalite ozugbo agaghị ekwe omume, wepụ ọnọdụ mkpalite ọdabara: gbanyụọ adịghị mkpa SSI / AIO ma ọ bụ HTTP/3 , nyochaa adịghị ike `alias` / `rewrite` / `map` nrụtụ aka na-agbanwe agbanwe, ma nyochaa nwa oge `ssl_session_tickets off;` maka emetụtara mTLS ọrụ. WAF , ASLR , oke ọnụego na mgbanwe nhazi na-ekpuchi naanị ọnọdụ ụfọdụ na enweghị ike dochie patches ndị ọrụ. [S3](https://keendigit.com/ig/insights/nginx-remediation-guide#source-3) [S4](https://keendigit.com/ig/insights/nginx-remediation-guide#source-4) [S8](https://keendigit.com/ig/insights/nginx-remediation-guide#source-8) [S12](https://keendigit.com/ig/insights/nginx-remediation-guide#source-12) ## 1. Nleba anya ihe ọghọm na ikpe ihe egwu NGINX wepụtara 1.30.6 (Stable) na 1.31.7 (Mainline) na Ọktoba 14, 2026, na-edozi nsogbu nchekwa ise. Atọ gụnyere oke oke oke ma ọ bụ iji ya emechaa n'efu wee nata F5 CVSS v4.0 akara nke 9.2 / Critical. Abụọ ndị ọzọ na-emetụta HTTP/3 arịrịọ iguzosi ike n'ezi ihe na TLS ahịa akwụkwọ nyocha. [S1](https://keendigit.com/ig/insights/nginx-remediation-guide#source-1)[S2](https://keendigit.com/ig/insights/nginx-remediation-guide#source-2)[S3](https://keendigit.com/ig/insights/nginx-remediation-guide#source-3) Chọpụta usoro nhazi ọkwa: nginx.org depụtara okwu ise niile dị ka `medium`, ebe F5 CVSS v4.0 na ụfọdụ ụlọ ọrụ nchekwa obodo na-ekewa okwu ebe nchekwa atọ dị ka Critical. Nke a apụtaghị na ise niile na-enye ohere igbu koodu ime obodo na-enweghị atụ. Nhazi, nnweta okporo ụzọ na ọnọdụ na-abụghị ihe njikwa onye mwakpo. Nrụrụ ebe nchekwa na RCE a pụrụ ịdabere na ya bụ ọkwa dị iche iche. [S1](https://keendigit.com/ig/insights/nginx-remediation-guide#source-1)[S3](https://keendigit.com/ig/insights/nginx-remediation-guide#source-3)[S4](https://keendigit.com/ig/insights/nginx-remediation-guide#source-4) | CVE | Usoro nka na ụzụ na ọnọdụ akpalite ahụkarị | isi mmetụta | Nlele na mkpofu | | -------------- | ------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------ | | CVE-2026-15176 | `alias` nkewa ụzọ + `rewrite` gbanwere URI + nyocha `$request_filename` | Okpokoro ihe njupụta, okuku Worker; enwere ike RCE n'okpuru ọnọdụ ụfọdụ | F5 CVSS v4.0 9.2; nye ụzọ nchọpụta nsogbu ụzọ | | CVE-2026-93479 | Nyocha ederede HTTP/Stream, ọkachasị `map` regex njide na akwụkwọ ndekọ aha root, log na-agbanwe ntụgharị ntụgharị. | A na-edegharị ihe nchekwa echekwabara ma obo ahụ tojuru; enwere ike RCE n'okpuru ọnọdụ ụfọdụ | F5 CVSS v4.0 9.2; bụ ihe ize ndụ nlọghachi azụ mgbe mmezigharị gara aga | | CVE-2026-97205 | SSI mebere na-agụnye yana AIO/arụ ọrụ asynchronous; pụtara oke ọrụ ọnụ oke | Jiri-Mgbe-efu, Worker okuku, ebe nchekwa nrụrụ; enwere ike RCE | F5 CVSS v4.0 9.2; chọrọ nhazi na-abụghị nke ndabara | | CVE-2026-95101 | HTTP/3 Frame amaghi ama na-ekewa n'ofe nchekwa nchekwa, agbanyere ihe nchekwa ahụ arịrịọ proxy | Ịgbanye bytes na-abụghị DATA na ezighi ezi n'ime ahụ arịrịọ dị elu, ikekwe gafere oke nha nke arịrịọ ahụ. | Nke a adịghị ike na-emetụta iguzosi ike n'ezi ihe nke arịrịọ. Ọ bụghị n'onwe ya na-enye mpụ koodu mkpochapụ (RCE). | | CVE-2026-97629 | Cache nnọkọ TLS ekekọrịtara, ntụgharị igodo akpaka na ntụgharị igodo Worker | Ụgha tiketi nnọkọ; Nyocha akwụkwọ ikike ndị ahịa nwere ike ime maka ọrụ mTLS emetụtara | Ekwesịrị itinye nlebara anya pụrụ iche na mmetụta azụmaahịa nke ụdị njirimara asambodo API. | Akara CVSS dị n'elu bụ F5 na-eji v4.0; Otu adịghị ike ahụ nwere ike igosi ịdị njọ dị iche iche na CVSS 3.1, nginx.org akara ule nke ya na ogo nkesa ike. [S1](https://keendigit.com/ig/insights/nginx-remediation-guide#source-1)[S3](https://keendigit.com/ig/insights/nginx-remediation-guide#source-3)[S4](https://keendigit.com/ig/insights/nginx-remediation-guide#source-4) ### 1.1 na-ebute mkpughe mbugharị ụzọ karịa akara CVE naanị | Ụdị ntinye | Isi ihe nyocha | Ntụnye mkpa mkpofu | | --------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------ | ---------------------------------------------------- | | Onye nnọchi anya netwọkụ netwọk ọha, gụnyere ahaziri `rewrite`, `alias`, yana mgbagwoju `map` | CVE-2026-15176, CVE-2026-93479 wee degharịa / maapụ adịghị ike site na Mee ruo Julaị | P0: Nyochaa ma melite ozugbo | | API / Management ụgbọ elu iji ahịa akwụkwọ dị ka naanị ma ọ bụ isi nbata nyocha | Tiketi nnọkọ yana nhazi cache nkekọrịta nke CVE-2026-97629 | P0: kwenye ozugbo oke nyocha na nwelite | | Nye mbulite HTTP/3 mpụga, interface mgbanwe ọkwa, klas azụmahịa API | CVE-2026-95101, ọkachasị ahụ na-arịọ arịrịọ bụ proxied na azụ azụ | P0/P1: Hazie dịka mkpa azụmahịa siri dị | | SSI Ibe akwụkwọ dị omimi ma ọ bụ faịlụ asynchronous I/O | CVE-2026-97205 | P1: Kwado ọnọdụ nchikota ma rụkwaa ozugbo enwere ike | | Naanị ibe kwụ ọtọ + dị mfe HTTP/1.1/2 proxy reverse | Nhazi na ụdị ka kwesịrị ka enyocha ya, mana ụfọdụ ọnọdụ CVE nwere ike na-efu | P1: Tinyere na windo nkwalite nchekwa mberede | | Jiri Kubernetes Community ingress-nginx lara ezumike nká | Ihe oru ngo a na-akwụsị mmezi nchekwa, na ihe ize ndụ na-ejedebeghị na CVE ise ndị a | Mee atụmatụ mbugharị onye njikwa n'otu n'otu | P0/P1 bụ ọrụ na ntụnye mkpofu a na-enye n'ime edemede a maka ikpughe netwọk ọha na ikike nzere. Ọ bụghị ọkwa CVSS gọọmentị, ma ọ bụ na ọ gaghị edochi uru dị n'ime ụlọ ọrụ ma gbanwee ntule ihe egwu. ### Oke mmetụta 1.2 ikike mbuso agha Isi adịghị ike dị na batch a bụ nke dị na NGINX Data Plane: ebe ntinye mbuso agha bụ njikọ na arịrịọ ndị ahịa, mmetụta ya na-emekarị na usoro Worker. Ọ bụrụ na ezutere ọnọdụ nrụrụ aka nke ebe nchekwa, ikike mmezu koodu na-amachibidokarị onye ọrụ na-agba ọsọ, ihe mgbochi akpa, ikike Linux, ịgbanye na ikike netwọkụ nke Worker; ikike RCE apụtaghị na akpaghị aka ikike root ma ọ bụ nnabata nnabata. [S4](https://keendigit.com/ig/insights/nginx-remediation-guide#source-4) Mana ọbụlagodi na usoro a enweghị ihe ùgwù, ọ ka nwere ike nweta nzere proxy, faịlụ enwere ike nwere igodo nzuzo, akara ọrụ elu, faịlụ nwa oge, API dị n'ime, yana netwọk enwere ike iru. Maka mTLS, ngafe nyocha n'onwe ya nwere ike bụrụ nsonaazụ azụmahịa siri ike, na ọ bụchaghị na koodu mmebe ga-esonyere ya. ## 2. Ihe kpatara nyocha ### 2.1 Ghọta oke oke atọ nwere mmejọ na NGINX Otu NGINX worker bụ ogologo ndụ, usoro mmemme na-akwalite nke na-akwado ọkwa arịrịọ, ọrụ asynchronous na protocol parsers. Nke a adịghị ike na-agụnye ihe mgbochi na ọkwa injinia atọ: 1. Ntụle mgbanwe na nha ebe nchekwa aghaghị ịdị na-agbanwe agbanwe: `rewrite` Mgbe ịgbanwere arịrịọ URI, nkewa ụzọ ga-adabarịrị na nke dị ugbu a `location`; mgbe onye ntụgharị ederede na-agbakọ ogologo agbanwe agbanwe, oghere ederede ga-ekpuchirịrị nsonaazụ na mpaghara echekwara. 2. Asynchronous arụmọrụ ga-agbatịkwu okirikiri ndụ nke ebe nchekwa a rịọrọ: Mgbe enwere ịgụ na ide faịlụ emechabeghị, nchere cache ma ọ bụ ọrụ eri, enweghị ike iwepụta ọdọ mmiri ebe nchekwa dị mkpa tupu oge eruo. 3. Enweghị ike ịgwakọta ma ọ bụ hapụ ọkwa usoro protocol na ọkwa nchekwa: HTTP/3 Ogologo oge mwụpụ etiti amaghi ama dịka DATA arịrịọ ogologo ahụ; TLS Oghere igodo niile na-esonye na nkwenye mbinye aka ga-enwerịrị ibido ma mekọrịta ya n'oge ntụgharị tiketi nnọkọ. Ọdịnaya na-esote dabere na NGINX upstream fix commitment na onye na-ere ahịa iji kọwaa usoro ọdịda nke enwere ike ịkpalite; iberibe ihe atụ bụ maka nyocha, ọ bụghị koodu zuru oke nke enwere ike iji mee ihe ozugbo iji rụkwaa ebe mmepụta ihe. [S5](https://keendigit.com/ig/insights/nginx-remediation-guide#source-5)[S6](https://keendigit.com/ig/insights/nginx-remediation-guide#source-6)[S7](https://keendigit.com/ig/insights/nginx-remediation-guide#source-7)[S8](https://keendigit.com/ig/insights/nginx-remediation-guide#source-8)[S9](https://keendigit.com/ig/insights/nginx-remediation-guide#source-9) ### 2.2 CVE-2026-15176: Usoro nkewa n'etiti `alias` na edegharịrị URI adịghị mma. Na NGINX, `location` dakọtara na `alias` na-ekpebi ụzọ faịlụ; `rewrite` nwere ike ịgbanwe arịrịọ ugbu a URI. Mgbe idegharịgharị, echiche ndị mbụ `location` maapụ nwere ike ọ gaghị adịgide. Ụzọ nhazi emetụtaghị nke ọma ma e degharịrị arịrịọ a mgbe ị na-elele ọkwa `alias` na `ngx_http_map_uri_to_path()`. Mgbe nhazi ahụ na-aga n'ihu na-enyocha `$request_filename` mgbe e degharịrị, enwere ike ịmepụta ụzọ ahụ site n'echiche ndị na-adabaghị na ọnọdụ URI dị ugbu a, na-emecha na-eme ka mpụ na-ede akwụkwọ na ebe nchekwa. [S5](https://keendigit.com/ig/insights/nginx-remediation-guide#source-5) Ngwakọta a na-ahụkarị (naanị eji dị ka ihe nlere anya maka nyocha nhazi, anaghị atụ aro ibunye ya): ```nginx # 仅用于识别风险模式：不是修复配置 location /foo/ { alias /srv/alias-root/; rewrite ^/foo/.*$ /new-path; return 200 $request_filename; } ``` Ihe ize ndụ ahụ ejedebeghị na `return`: `set`, `if`, `add_header`, `log_format`, wdg nwekwara mkpa ka enyocha ya ma ọ bụrụ na `$request_filename` nyocha na-akpalite na otu usoro arịrịọ. `return` na ihe atụ na-eme ka ụzọ steeti a dị mfe ịhụ, enweghị ike iji ya mee ka ọ pụta ìhè na nhazi mmepụta niile ga-emepụta oke mmiri. [S5](https://keendigit.com/ig/insights/nginx-remediation-guide#source-5)[S10](https://keendigit.com/ig/insights/nginx-remediation-guide#source-10) Nsonaazụ nke mbuso agha: Ịrụ arịrịọ nwere ike ime ka Worker malitegharịa ma ọ bụ nkwụsị ọrụ; N'okpuru ọnọdụ dịka ASLR na-emechi ma ọ bụ nwee ike ịgafe ya, enwere ike RCE. Isi ihe dị na patch nke dị n'elu bụ ịjụ imecha maapụ ụzọ URI edegharịrị na ọnọdụ `alias` nke na-adịkwaghị adị, kama ịgbasa naanị ihe nchekwa. [S5](https://keendigit.com/ig/insights/nginx-remediation-guide#source-5)[S10](https://keendigit.com/ig/insights/nginx-remediation-guide#source-10) ### 2.3 CVE-2026-93479: adabaghị n'etiti "ohere echekwara" na ezigbo ogologo mgbanwe na nyocha edemede Ụdị HTTP na Stream nke NGINX nwere ndị nyocha edemede na-ejikọta eriri nkịtị na ụkpụrụ agbanwe agbanwe n'ime eriri nsonaazụ. Ọmụmaatụ ngwa gụnyere ụzọ HTTP akwụkwọ root, ụzọ ntinye akwụkwọ, na okwu mgbanwe na Stream. Ụfọdụ nhazi nke `map` + okwu oge niile na-enye ohere ka e jiri okwu ndị ọzọ gụọ ụkpụrụ ejidere tupu enyocha mgbanwe nsonaazụ `map`. Ejikọtara ya na usoro mmebe script nwere ogologo echekwabara, mmejuputa ochie ga-agụta oghere `len` echekwabara n'ime ogologo mkpokọta enyochala tupu oge eruo, nke mere na ngụkọ ihe nrịbama ederede na-esote anaghị adaba na oke nchekwa. N'ime usoro ntule mgbanwe dị iche iche, eriri na-esote nwere ike degharịa mpaghara echekwara, na-ebute oke oke. [S6](https://keendigit.com/ig/insights/nginx-remediation-guide#source-6) | ihe ntinye aka | Ihe mere o ji dị mma ịṅa ntị | | --------------------------------------------- | ----------------------------------------------------------------------------------------------- | | regex na `map` | Ntule na-agbanwe agbanwe nwere ike ịnwe usoro ndụ onwe ya na omume caching | | Mweghara amaghị aha dị ka `$1`, `$2`, wdg. | Edere ya ngwa ngwa site na okwu ma ọ bụ okwu ndị ọzọ mgbe niile, na-eme ka ọ sie ike ịchọta nwe | | Mgbanwe na `root` | Ndobe ederede na ndoputa ihe mgbe ị na-ebuli ụlọ ụzọ | | `log_format`/Dzọ ndekọ aha na-agbanwe agbanwe | Enwere ike ịkpalite otu ụdị nyocha ahụ ma emechaa na arịrịọ ahụ | | Okwu ederede na `stream` | Ndozi mgbago elu na-agbanwekwa `ngx_stream_script_run()`. Ị nweghị ike ịlele modul HTTP naanị. | Mmekọrịta nlọghachi azụ dị mkpa: Koodu metụtara adịghị ike a metụtara mgbanwe ndị gara aga nke edobere CVE-2026-42533. DSA gọọmentị maka Debian 13 na-ekwu n'ụzọ doro anya na ewebatara koodu emetụtara na ngwugwu trixie site na nchekwa nchekwa mbụ. Ya mere, "July `map` vulnerability patch ka etinyere" apụtaghị na ekpuchiwo CVE-2026-93479 nke October; Ekwesịrị ịlele yinye ndozi nchekwa zuru oke. [S6](https://keendigit.com/ig/insights/nginx-remediation-guide#source-6)[S14](https://keendigit.com/ig/insights/nginx-remediation-guide#source-14)[S17](https://keendigit.com/ig/insights/nginx-remediation-guide#source-17) Ihe ize ndụ RCE nwere ike ime ebe a metụtara ebe nchekwa nchekwa, na e kwesịghị ikwu na `map` regex naanị ga-enwe ike irigbu ya site n'aka ndị mwakpo na-amaghị aha. [S11](https://keendigit.com/ig/insights/nginx-remediation-guide#source-11) ### 2.4 CVE-2026-97205: AIO Ọnụ ọrụ emechabeghị ọnụ ihe mkpuchi na-akpata ojiji-Mgbe-efu. Nke a adịghị ike abụghị naanị "gbanye SSI na ị ga-enweta UAF". Igodo dị na ọnụọgụ ntụaka ọrụ asynchronous nke isi arịrịọ nwere. NGINX Jiri `r->main->blocked` soro nhazi asynchronous nke emechabeghị, na mmejuputa ochie ọ bụ ọnụọgụ 8-bit; ụzọ ụfọdụ emeghị nlele oke oke tupu ha abawanye ọnụ. Mgbe otu isi arịrịọ ahụ na-agbakọ ọrụ 256 pụtara ìhè, ọnụ ọgụgụ ahụ nwere ike kechie site na 255 ruo 0. Usoro ndị na-esote ga-ekwenye n'ụzọ ezighi ezi na ọ nweghị ọrụ asynchronous na-egbochi arịrịọ ahụ ka ahapụ ya, si otú a na-ahapụ ọdọ mmiri ebe nchekwa arịrịọ nke a ka na-ezo aka na ọrụ ahụ. [S7](https://keendigit.com/ig/insights/nginx-remediation-guide#source-7) Enwere ike kewaa usoro ọdịda ahụ na: 1. Site na agbanyere ụzọ asynchronous I/O/thread jikọtara ya, ibe SSI na-ewebata ọtụtụ arịrịọ ma ọ bụ gụọ ọrụ site na `include virtual`. 2. A na-akwakọba arụmọrụ pụtara ìhè nke otu isi arịrịọ ruo oke oke nke mpaghara ọnụ ọgụgụ nọchiri anya ya. 3. Ọnụọgụ 8-bit gbara gburugburu, akọwapụtaghị nke ọma dị ka "enweghị ọrụ na-echere". 4. A na-ewepụta ọdọ mmiri ebe nchekwa arịrịọ, ka faịlụ na-agụ, cache na-echere, ma ọ bụ nkwughachi nke ọrụ eri ka na-ejigide ntụaka na ya. 5. Ndaghachi oku mmecha asynchronous na-esote na-enweta ebe nchekwa ewepụtara, butere UAF, Worker daa ma ọ bụ nrụrụ ebe nchekwa nwere ike. Ndozi ọrụ ahụ na-agbakwụnye `NGX_HTTP_MAX_BLOCKED 250` na faịlụ nkụnye eji isi mee ihe, ma na-agbakwụnye ihe mgbochi na nzacha mmepụta, ịgụ cache, na ụzọ eriri elu; Mgbe a rutere n'ọnụ ụzọ, arụ ọrụ nwere ụzọ mekọrịtara ọnụ na-arụkọ ọrụ ọnụ, ma ọ bụrụ na enweghị ike ịhazi ya n'enweghị nsogbu, a ga-ajụ mgbakwunye ọzọ nke ọrụ na-echere. [S7](https://keendigit.com/ig/insights/nginx-remediation-guide#source-7) Mkpebi ikpe: A ga-enyocharịrị ma SSI, AIO, ntinye mebere, arịrịọ subrequest na arụmọrụ asynchronous nwere ike ime na ngwakọta n'otu agbụ arịrịọ ahụ. Ndị a anaghị abụkarị nhazi proxy static dị larịị. `aio off;` ma ọ bụ `ssi off;` nwere ike wepụ ihe ndị na-akpalite kpọmkwem, mana a ga-ebu ụzọ kwenye ịdabere na ọrụ azụmahịa. [S4](https://keendigit.com/ig/insights/nginx-remediation-guide#source-4)[S7](https://keendigit.com/ig/insights/nginx-remediation-guide#source-7)[S25](https://keendigit.com/ig/insights/nginx-remediation-guide#source-25) ### 2.5 CVE-2026-95101: HTTP/3 amaghi etiti na mgbagwoju anya na ọnọdụ nke DATA arịrịọ ahu Ihe ntụgharị etiti HTTP/3 ga-amarịrị ọdịiche dị n'etiti okpokolo agba `DATA` (nke a ga-ebufe na nhazi arịrịọ HTTP) yana okpokolo agba amabeghị nke ekwesịrị ịwụpụ. Ogologo nke okpokolo agba amaghi ama ga-echekwarịrị nke ọma mgbe a na-ekewa n'ofe nchekwa netwọkụ. Mmezu ochie nke `ngx_http_v3_parse_data()` jiri mpaghara `st->length` chekwaa “ọnụọgụ bytes fọdụrụ ka a ga-awụpụ” mgbe ị na-amafe okpokolo agba amaghi ama, ebe nzacha ahụ na-arịọ arịrịọ tụgharịrị otu ubi ahụ dị ka “ogologo DATA fọdụrụnụ”. Ọ bụrụ na okpokolo agba amaghi ama mere n'ọtụtụ oku nzagharị, enwere ike imehie ogbe bytes na-esote ka emechara nlegharị anya dị ka akụkụ nke ahụ arịrịọ. [S8](https://keendigit.com/ig/insights/nginx-remediation-guide#source-8) Ụdị ihe egwu abụọ na-ebilite: - Rịọ ogbugba ahụ: Enwere ike ibunye ụgwọ akwụ ụgwọ na-abụghị nke DATA nke onye ahịa nyefere na ngwa elu, na-agbanwe data nke azụ azụ nwetara n'ezie. - ngafe nha nha: `client_max_body_size` na mgbochi ndị ọzọ. Nlebanya ndị a na-atụ anya ka etinyere n'ụzọ DATA, yana ọdịnaya agbanweghị ezighi ezi nwere ike gafere nkwenye kwekọrọ. Ihe omume na-akpalite nke onye ọrụ gọọmentị kọwara bụ mgbe `ngx_http_v3_module` natara arịrịọ HTTP/3 wee zipu `proxy_request_buffering on`. A na-akwado nkwado ahụ proxy site na ndabara na `ngx_http_proxy_module`. Ya mere, a ga-ebu ụzọ lelee proxy reverse nke na-agbanye HTTP/3. O kwesịghị ekwesị iche na ọ dịghị ọnọdụ mkpalite naanị n'ihi na edeghị `proxy_request_buffering on;` n'ụzọ doro anya. [S8](https://keendigit.com/ig/insights/nginx-remediation-guide#source-8)[S18](https://keendigit.com/ig/insights/nginx-remediation-guide#source-18) Nsonaazụ nke adịghị ike a bụ nke nkwụghachi azụ arịrịọ iguzosi ike n'ezi ihe na mgbanwe ókèala nchekwa, nke na-abụghị nke okwu RCE dechara ozugbo na isi NGINX. Mmetụta azụmaahịa kacha adabere n'otu esi atụgharị bytes ndị a na ntụkwasị obi elu. [S24](https://keendigit.com/ig/insights/nginx-remediation-guide#source-24) ### 2.6 CVE-2026-97629: TLS ntụgharị tiketi tụfuru oghere igodo nke atọ Na nhazi emetụtara, NGINX nwere ike ịmepụta na tụgharịa TLS igodo nnọkọ site na cache ebe nchekwa nkekọrịta, na-enye ohere ka ọtụtụ Worker hazie otu batch nke tiketi. Ihe mgbagha mmekọrịta dị mkpa na-ekenye oghere igodo 3 maka Worker nke ọ bụla, na oku nbipu ga-agafe oghere ndị a; ma ochie mmejuputa iwu naanị oyiri 2 isi ohere mpere si òkè ebe nchekwa oge ọ bụla, na-akpata isi aha, HMAC igodo na AES nke atọ oghere. Igodo ahụ nwere ike ịnọgide na-ebughị ụzọ. Ọ bụrụ na njirimara igodo nke tiketi dabara na ọkwa a, enwere ike iji ihe isi ihe na-enweghị mmalite maka nkwenye mbinye aka na mwepu, si otú a na-etolite ụzọ iji chepụta nnọkọ TLS. [S9](https://keendigit.com/ig/insights/nginx-remediation-guide#source-9) Ngwakọta ibunye ihe egwu dị elu na-abụkarị: ```nginx # 仅为排查触发条件所示：共享缓存本身不是恶意配置 ssl_session_cache shared:SSL:10m; # 未显式配置 ssl_session_ticket_key 文件，使用自动轮换机制 ``` Nsonaazụ azụmaahịa kacha njọ sitere na adịghị ike a bụ na na ọrụ ndị na-eji nyocha asambodo ndị ahịa (mTLS) na `ssl_verify_client on;` na ụzọ ndị ọzọ, oge mgbake adịgboroja nwere ike gafere nkwenye asambodo ndị ahịa. Ọganihu nke mwakpo ahụ dịkwa n'okpuru ọnọdụ enweghị nchịkwa; saịtị nke na-eji naanị asambodo HTTPS n'akụkụ ihe nkesa na-enweghị nyocha nke onye ahịa ekwesịghị ịkọwapụta ya dị ka "onye na-awakpo nwere ike gafere nbanye webụsaịtị niile." [S9](https://keendigit.com/ig/insights/nginx-remediation-guide#source-9)[S12](https://keendigit.com/ig/insights/nginx-remediation-guide#source-12) Nke a bụ okwu nyocha ọkwa nnọkọ TLS na enweghị ihe jikọrọ ya na igodo nzuzo TLS nke sava ahụ agbawara ma ọ bụ na emetụtara asambodo CA root ọha. [S24](https://keendigit.com/ig/insights/nginx-remediation-guide#source-24) ### 2.7 Otu esi aghọta DoS, RCE, ngafe nyocha na nrigbu amaara - DoS: Njehie ebe nchekwa na-eme ka Worker daa ma ọ bụ malitegharịa nke ukwuu. Ma ọ na-akpata enweghị nnweta n'ozuzu ya metụtara nrụgide okporo ụzọ, ikike ịmalitegharị usoro, oge mmezi njikọ yana ihe nrụpụta dị elu. - nwere ike RCE: Ụfọdụ ọkwa na-egosi na enwere ike ịme koodu mgbe emechiri ma ọ bụ gafere ASLR. Nke a apụtaghị na ekpughere ụdọ mwakpo ọha na eze nwere ike guzosie ike ma na-emezu iwu zuru ụwa ọnụ. [S4](https://keendigit.com/ig/insights/nginx-remediation-guide#source-4) - Rịọ ịgba ọgwụ mgbochi/ ngafe nyocha: Ọ nwere ike gbanwee ọnọdụ azụmaahịa echekwara ozugbo ma ọ bụ rịọ ọdịnaya, enweghị ike ileghara ya anya naanị n'ihi na ọ naghị enweta shei ozugbo. - achọpụtala mbọ mbuso agha: CVE-2026-42945 na Mee 2026 nwere akụkọ banyere ọrụ nrigbu n'ime ọhịa; ekwesịghị ịkọwa eziokwu a akụkọ ihe mere eme ozugbo na-egosi na ejirila CVE ise niile dị na Ọktoba nke ọma n'ọtụtụ buru ibu. [S23](https://keendigit.com/ig/insights/nginx-remediation-guide#source-23) ## 3. Ndozi ụdị na nhọrọ patch ### 3.1 NGINX Open Source akara nkwado ndabere na mpaghara | alaka elu ugwu | Versiondị gọọmentị izizi na-ekpuchi adịghị ike ise na Ọktọba | Nkwanye dị ka nke 2026-10-27 | | --------------------------- | --------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | | Stable 1.30.x | 1.30.6（2026-10-14） | Wụnye opekata mpe 1.30.6, wee soro ụdị nchekwa na-esote. | | Mainline 1.31.x | 1.31.7（2026-10-14） | 1.31.8（2026-10-21） | | Alaka NGINX Open Source mbụ | Enweghị ike ikpe ya ikpe naanị na "etinyere patches adịghị ike ochie" | buru uzọ kwaga n'alaka ahu edoziworo; ma ọ bụghị ya, a chọrọ onye na-ere ahịa ka ọ nye ihe akaebe nke nkwado na ndabere CVE-by-CVE. | Ndị a bụ nkwubi okwu nke koodu isi mmalite nginx.org na ngalaba ọrụ, na ekwesighi iji ya gọnarị ngwungwu nchekwa ozugbo yana ndozi azụ azụ nke onye na-ere nkesa nyere. Ọbụlagodi na uru `1.31.6` dị ukwuu karịa `1.30.6`, ọ ka dị ala karịa ntọala patch nke ngalaba isi. [S1](https://keendigit.com/ig/insights/nginx-remediation-guide#source-1)[S2](https://keendigit.com/ig/insights/nginx-remediation-guide#source-2) ### 3.2 Oke mmetụta dị elu nke CVE ise Edepụtara oke ndị a dị ka ederede izizi nke akwụkwọ akụkọ nchekwa nginx.org siri dị ma ọ dị mkpa ka aghọta ya na njikọ "alaka na-agba ọsọ ugbu a" yana "ụzọ nhazi n'ezie": | CVE | Ụdị mkpado ndị dị n'elu emetụtara | Ụdị edozila nke aha ya bụ eze | | -------------- | --------------------------------- | --------------------------------------------------------- | | CVE-2026-15176 | `0.1.29–1.31.6` | `1.30.6+` ma ọ bụ `1.31.7+`, n'ime alaka ha dị iche iche. | | CVE-2026-93479 | `1.30.0–1.30.5`，`1.31.2–1.31.6` | Otu dị ka n'elu | | CVE-2026-97205 | `0.8.11–1.31.6` | Otu dị ka n'elu | | CVE-2026-95101 | `1.25.0–1.31.6` | Otu dị ka n'elu | | CVE-2026-97629 | `1.23.2–1.31.6` | Otu dị ka n'elu | CVE-2026-93479 nwere oke mmeghe-ụdị; Ọ bụghị ụdị NGINX ochie ọ bụla na-emetụta nlọghachi azụ a. Ụdị ndị ochie na-abụghị oke ndị ahụ ka nwere ike imetụta ya na mbụ `map` regex vulnerability CVE-2026-42533. [S1](https://keendigit.com/ig/insights/nginx-remediation-guide#source-1) ### 3.3 Ubuntu: ọdụ ụgbọ mmiri nkesa (USN-8955-1) Canonical USN-8955-1 October 26, 2026 na-enye mmelite nchekwa maka anọ Ubuntu na-ewuli: [S13](https://keendigit.com/ig/insights/nginx-remediation-guide#source-13) | Ụdị Ubuntu | `nginx` na otu ụdị ngwugwu edoziri | Nkọwa | | ---------- | ---------------------------------- | -------------------------------------------------------------- | | 22.04 LTS | `1.18.0-6ubuntu14.22` | Ọ bụ onye na-ere azụ azụ; Nọmba ụdị nke elu ka na-egosi 1.18.0 | | 24.04 LTS | `1.24.0-2ubuntu7.19` | Otu dị ka n'elu | | 26.04 LTS | `1.28.3-2ubuntu1.12` | Otu dị ka n'elu | | 26.10 | `1.30.4-7ubuntu1.1` | Otu dị ka n'elu | Ọkwa a nwere ụdị ngwungwu ihe jikọrọ ọnụ dịka `nginx-core`, `nginx-extras`, `nginx-full`, na `nginx-light`. Emela nkwubi okwu banyere ma a ga-edozi ya site na akụkụ elu nke naanị `nginx -v` gosipụtara. dị ka Ubuntu 24.04 na `1.24.0-2ubuntu7.19` bụ onye na-ere ahịa ejirila akwachie ya, mana `1.24.0` sitere na ebe ọ bụla adịghị mma. Ubuntu n'ihu ọha gosikwara nke ahụ n'ụzọ doro anya CVE-2026-95101 na-emetụta naanị Ubuntu 26.04 / 26.10 , na CVE-2026-97629 na-emetụta naanị Ubuntu 24.04 / 26.04 / 26.10. Nke a bụ Ubuntu Nkwakọ ngwaahịa na oke ọrụ nke onwe ya, nke enweghị ike ịkwalite ozugbo na nkesa ndị ọzọ. [S13](https://keendigit.com/ig/insights/nginx-remediation-guide#source-13) ### 3.4 Debian: Ọdịiche dị n'etiti nsụgharị ga-enyocharịrị iche. Ndụmọdụ Debian DSA-6575-1 (2026-10-21) kpuchiri CVE ise ndị a wee chọpụta ngwungwu `nginx` edobere maka Debian 13 / trixie dị ka: ```text 1.26.3-3+deb13u10 ``` Agbanyeghị, n'oge nkwenye nke akụkọ a, `1.22.1-9+deb12u10` maka Debian 12 / bookworm ka na-egosi dị ka onye na-ahụ maka nchekwa Debian. Ya mere: - Debian 13 Naanị melite ma nabata dịka DSA-6575-1 si dị. - Debian 12 ga-elele ndozi nchekwa nke onye na-ahụ maka nchekwa ugbu a ma ọ bụ onye na-ere ELTS nyere otu otu; tupu ekwenye na ndozi ahụ na ọkwa ahụ, ekwula na ihe ise ahụ niile edoziwo dabere na ihe ịga nke ọma nke `apt upgrade`. - Ihe ngwungwu isi Debian nwere ike ibu ihe ngwungwu anọghị na nọmba ụdị nginx.org. Maka iwulite omenala, ịkwesịrị ịlele nhazi ngwungwu koodu isi mmalite zuru oke, ma ị nweghị ike ịdepụta otu nkwa elu ma chee na ọ zuru oke. Ọdịiche a dị n'elu dabere na ndekọ ndekọ DSA na CVE. [S14](https://keendigit.com/ig/insights/nginx-remediation-guide#source-14)[S15](https://keendigit.com/ig/insights/nginx-remediation-guide#source-15)[S16](https://keendigit.com/ig/insights/nginx-remediation-guide#source-16) ### 3.5 NGINX Plus, njs na Ingress Controller | Ngwaahịa/ Akụrụngwa | Nhọrọ nchekwa yana isi ihe nyocha | | --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | NGINX Plus (ụdị azụmahịa) | Biko rụtụ aka na ntụzịaka ọkwa na nkwalite nke ngalaba Plus dabara na F5. CR kacha ọhụrụ n'oge nkwenye bụ `PLS.37.2.0.1`, na nchekwa nchekwa nke LTS bụ `PLS.37.0.7.1`; enweghị ike dochie ụdị gbakwunyere na azụ azụ agụnyere ozugbo site na ọnụ ụzọ 1.30/1.31. [S19](https://keendigit.com/ig/insights/nginx-remediation-guide#source-19) | | njs / ngx\_http\_js\_module | 2026-10-14 weputara `njs 1.0.2` wee dozie CVE-2026-101019 na CVE-2026-101025; ọ bụrụ na ị na-eji njs, ị ga-elelekwa ndakọrịta nke modul na NGINX. [S20](https://keendigit.com/ig/insights/nginx-remediation-guide#source-20) | | F5 NGINX Onye njikwa mbata / akwa ọnụ ụzọ ámá | Isi NGINX bụ yinye nkesa ngwanrọ nwere njikọ ma nweere onwe ya. Dozie adịghị ike ndị dị mkpa na ndị njikwa ha, onyonyo na ndetu mwepụta ha. Ị nweghị ike dochie ọnụọgụ abụọ NGINX na Pod. | | Kubernetes Ogbe `kubernetes/ingress-nginx` | Akwụsịla ọrụ a na Maachị 2026 ma agaghịkwa enye mmezi nchekwa ọhụrụ. Ị ga-eme atụmatụ ịkwaga na onye njikwa echekwara ma ọ bụ Gateway API kama imehie nọmba ntọhapụ ya maka F5 NGINX Ingress Controller. [S21](https://keendigit.com/ig/insights/nginx-remediation-guide#source-21) | ### 3.6 Kedu patch ị ga-ahọrọ n'ezie? | Ụdị ntinye | Omume akwadoro | Ihe akaebe nke nrụzi | | ----------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------- | | nginx.org ọrụ DEB/RPM ngwugwu | Kwalite gaa na ụdị nke alaka ụlọ ọrụ dị elu nke edobere | `nginx -v/-V`, isi iyi ngwugwu, ọkwa nchekwa gọọmentị | | Ubuntu/Debian ebe nchekwa ọrụ | Wụnye ngwungwu nchekwa ndị na-ere ahịa | Ụdị ngwugwu zuru oke + onye na-ere USN/DSA + ọkwa CVE | | RHEL/Alma/Rocky/SUSE/Nkesa ndị ọzọ | Kwalite dịka akwụkwọ akụkọ nchekwa nkesa na ụdị ngwugwu siri dị | CSAF/nkwuputa onye na-ere ahịa kwekọrọ, enweghị ike itinye ụdị Ubuntu/Debian. | | Onyonyo akpa ma ọ bụ ahaziri ahazi | wughachi ma ọ bụ dọpụta onyonyo nrụzi ekwenyesiri ike wee dochie ya n'usoro ntụgharị | Ihe mgbari onyonyo, wuo SBOM, NJ onyonyo pọd/akpa na-agba ọsọ | | NGINX chịkọtara onwe ya, OpenResty, Tengine ma ọ bụ ụdị ejiri modul ndị ọzọ mechie. | Mee ka iji ụdị nchekwa zuru oke nke onye na-echekwa ụzọ; rụpụta patch backports maka osisi a na-achọsi ike mgbe ọ dị mkpa | Ndozi adịghị ike ise, ndakọrịta ABI/module, otu na mgbagha azụmaahịa | OpenResty na Tengine bụ usoro ntọhapụ dị iche iche; Tebụl a na-akọwa naanị usoro nkwenye. apụtaghị na a na-emetụta ụdịdị ya niile n'otu oge dịka ọkọlọtọ NGINX, ma ọ bụ enweghị ike itinye patch koodu mgbago na-enweghị ihe ọ bụla. ## 4. Usoro mmezi nke ọma ### 4.1 Ndepụta nke ezigbo oge nke ịnweta okporo ụzọ mpụga Kpọkọtanụ maka ntinye ọ bụla opekata mpe: - Aha ngalaba, ndozi ibu/CDN/njikọ proxy ihu, ụzọ mkpughe saịtị na usoro netwọk ejiri. - Ngwaahịa NGINX (Open Source, Plus, Ingress, etc.), ụdị zuru oke, isi iyi ngwungwu, mgbari onyonyo. - `nginx -V` na-egosiputa modul ụlọ na nchịkọta mkpokọta; ma enwere njs, Lua, OpenResty, yana modul ike nke ndị ọzọ. - Ezigbo na-agba ọsọ master/worker PID, Ngalaba Ọrụ/Container/Pod, oyiri na Worker Node. - Nhazi `http`/`stream`, `server`, `location`, `include` dị irè. - Ma ọ ga-eme ka HTTP/3, mTLS, SSI/AIO, ụzọ ndekọ dị ike, mgbagwoju anya `map` na njide regex. Elelela naanị `/etc/nginx/nginx.conf` ndabara. Ebe mmepụta ihe na-ebukarị ọtụtụ saịtị, TLS na nhazi modul site na `include`. Enwere ike ịnwe ọtụtụ ụzọ nrụnye NGINX ma ọ bụ ọtụtụ ọkwa proxy. ### 4.2 Lelee ụdị na ozi nchịkọta ```bash # NGINX 版本及构建选项 nginx -v nginx -V 2>&1 # Linux：查看实际运行的 NGINX 进程 ps -eo pid,ppid,user,comm,args | grep '[n]ginx' # Debian / Ubuntu：查看完整已安装包版本、来源 apt-cache policy nginx # 兼顾 nginx-core / nginx-full / nginx-extras 等实际已安装包 dpkg-query -W 'nginx*' 2>/dev/null # RPM 系：以实际安装包及仓库公告为准 rpm -qa | grep '^nginx' ``` `nginx -V` na-akọ na owuwu nke ọnụọgụ abụọ a chọtara n'okporo ụzọ-iwu; ọ naghị egosi na worker na-agba ọsọ eburula ya. `nginx -v` nwere ike hapụ ngwungwu ngwungwu nkesa zuru oke, yabụ lelee njikwa ngwugwu ma ọ bụ ndekọ ndekọ ọkọnọ. ### 4.3 Mbupụ nhazi dị irè ma mee agba nke mbụ nke nyocha static `nginx -T` ga-anwale nhazi ahụ wee tụfuo nhazi ahụ jikọtara ọnụ. Mwepụta ahụ nwere ike ịnwe ozi dị nro dị ka nzere nyocha, ụzọ igodo, aha nnabata ime, wdg. A na-atụ aro ka ịchekwaa ọdụ ọdụ ahụ na ikike root yana ikike faịlụ nkeonwe, ma etinyela faịlụ mbụ na iwu ọrụ ọha: ```bash sudo sh -c 'umask 077; nginx -T > /root/nginx-effective.conf 2> /root/nginx-config-check.log' sudo grep -nE \ 'alias|rewrite|map[[:space:]]|request_filename|aio[[:space:]]|ssi[[:space:]]|quic|http3|proxy_request_buffering|ssl_session_cache|ssl_session_ticket_key|ssl_session_tickets|ssl_verify_client|log_format|root[[:space:]]' \ /root/nginx-effective.conf ``` Nke a bụ naanị onye na-achọ ụzọ ndoro-ndoro anya, ọ bụghị ngwa nyocha akpaaka CVE a pụrụ ịdabere na ya: 1. `grep` enweghị ike ikpebi ma mgbanwe ndị ahụ dị n'otu `location` ma ọ bụ otu agbụ nyocha arịrịọ, ma ọ bụ enweghị ike wepụta mmekọrịta nhazi ihe nketa. 2. `proxy_request_buffering on`, ụfọdụ cache na nhazi tiketi nwere ụkpụrụ ndabara, na ideghị ntuziaka kwekọrọ apụtaghị na ihe ize ndụ ahụ ga-apụ n'anya. 3. Nhazi nke ndị proxies reverse, CDN, akpa akụkụ, ma ọ bụ ndị njikwa emebere nwere ike ịdị iche na faịlụ ejiri aka nyocha. 4. Njirimara nke `NGINX Plus` na modul siri ike nwere ike ịdị mkpa ka akwado ya site na iji ngwaọrụ njikwa ọrụ nke ha. ### 4.4 Bugharịa ndozi site na ọwa ntụkwasị obi Debian/Ubuntu (ebe nchekwa nkesa ọrụ): ```bash sudo apt-get update apt-cache policy nginx # 升级发行版仓库中已经安装的 NGINX 及相关包； # 先确认 Candidate 属于修复版本，再执行升级。 sudo apt-get install --only-upgrade nginx # 对实际安装的 nginx-core / nginx-full / nginx-extras 等包 # 确认它们的版本和依赖一同达到厂商修复要求。 dpkg-query -W 'nginx*' 2>/dev/null ``` Usoro iwu a enweghị ike iwepụta ndozi nchekwa site na ikuku dị gịrịgịrị na-adibeghị. Karịsịa maka Debian 12, ọ bụrụ na ngwungwu kwalitere ka na-ahụta na ọ bụ ihe na-adịghị ike site na sistemụ nleba anya, nrụzi ndị ọzọ na-ere ahịa, ikewapụ ma ọ bụ usoro mbugharị chọrọ. [S13](https://keendigit.com/ig/insights/nginx-remediation-guide#source-13)[S14](https://keendigit.com/ig/insights/nginx-remediation-guide#source-14)[S15](https://keendigit.com/ig/insights/nginx-remediation-guide#source-15) nginx.org ngwugwu ọrụ: ```bash # 先确认仓库来自 nginx.org、目标分支和候选版本 apt-cache policy nginx # 经变更审批后再执行对应仓库的升级命令 sudo apt-get install --only-upgrade nginx ``` Ọ bụrụ na ị na-eji onwe achịkọtara, OpenResty, Tengine ma ọ bụ NGINX Plus, jiri ụdị ndozi nke onye na-akwado ya kwekọrọ na-akwado ma ghara ịgwakọta nginx.org, nkesa na ngwugwu nchekwa ndị ọzọ. Ekwesịrị idowe ọnụọgụ abụọ/oyiyi izizi, mbinye aka, na ngosipụta mbugharị mbugharị. arịa/Kubernetes: melite onyonyo a na-apụghị ịgbanwe agbanwe, dekọọ mgbari ya wee jiri ntugharị emebere dochie ihe ochie niile. `kubectl rollout status` na-akwado naanị na onye na-ahụ maka nnyefe agwụla; chọpụtakwa ihe mgbari onyonyo, ụzọ mbata na oyiri adịghị mma. ### 4.5 Nyochaa nhazi ma dochie ochie Worker ```bash sudo nginx -t # 按服务实际名称、主机高可用和变更窗口执行重启 sudo systemctl restart nginx sudo systemctl status nginx --no-pager # 核查真正存在的 master / worker ps -eo pid,ppid,user,comm,args | grep '[n]ginx' ``` Emela `nginx -s reload` dị ka ihe akaebe na ọnụọgụ abụọ na-agba ọsọ: nhazigharị nhazi nkịtị ka master ochie malite ndị ọrụ ọhụrụ na-enweghị dochie ya. NGINX na-akwado usoro nkwalite ọnụọgụ abụọ dị n'ịntanetị raara onwe ya nye, mana ọ chọrọ usoro na nkwenye ndị ọzọ. Na-enweghị usoro guzosiri ike, jiri ngbanwe okporo ụzọ dị elu nke ọrụ malitegharịa, ma ọ bụ bugharịa arịa nọchiri anya. [S22](https://keendigit.com/ig/insights/nginx-remediation-guide#source-22) Ọ bụrụ na ị jikwaa NGINX site na oghere `systemd`, edemede ntinye akpa, ma ọ bụ ọtụtụ nrụnye, ị ga-elele ebumnuche mmalite na ụzọ nhazi kama iche na `systemctl restart nginx` na-ekpuchi ọnọdụ niile. ### 4.6 Nabata ma mee nlọghachi azụ azụ azụ site na ezigbo ọnụ ụzọ mpụta A na-atụ aro ka ịrụ opekata mpe: - Hụ HTTPS nkịtị, ụzọ edegharịrị, akụrụngwa kwụ ọtọ na ibe eserese `alias` ziri ezi. - Nkesa `map` na-adị mgbe niile, ụzọ root na-agbanwe agbanwe, ụzọ ntinye akwụkwọ, ụzọ SNI/akwụkwọ ntinye akwụkwọ, yana Stream proxy ziri ezi. - Bụ mbulite nkịtị, nbudata chunked, arịrịọ API yana oke oke olu maka HTTP/3 (mgbe enyere ya) ka dị ka a tụrụ anya ya. - mTLS: Arịrịọ asambodo ziri ezi kwesịrị ịga nke ọma; Asambodo efu, kubie ume, ma ọ bụ enweghị ikike ka a ka ga-ajụ, na ịmaliteghachi/njikọ TLS ekwesịghị ịgbanwe ikike na mberede. - Ma ibe SSI na ịnweta faịlụ asynchronous bụ ihe nkịtị; ndekọ njehie ahụ egosighi arịrịọ na-ezighi ezi maka ntụnyere ebe nchekwa ma ọ bụ mkpọka Worker ugboro ugboro. - Mgbe mgbanwe okporo ụzọ gasịrị, usoro ụdị ochie na oyiri oyiyi ochie kwesịrị ịpụ. Ekwesịrị ịme ule na mpaghara nke aka ya ma ọ bụ ikike. Nnwale anwụrụ ọkụ nke arịrịọ nkịtị enweghị ike igosipụta na echekwala adịghị ike ebe nchekwa; N'ikpeazụ, a ga-ejikọtarịrị nabata ụdị nke ndị na-ebubata ngwaahịa, patch koodu isi iyi na ule oge ịgba ọsọ maka nnabata. ## 5. Mbelata usoro mgbe nkwalite ngwa ngwa agaghị ekwe omume Nkebi a bụ nhọrọ mbelata ihe egwu, ọ bụghị ndochi patch. Ekwesịrị ịkwado mgbanwe nhazi oge niile, mebie `nginx -t`, wepụta ya na batches, wee tụgharịa ngwa ngwa ma ọ bụrụ na ọ dị mkpa. [S3](https://keendigit.com/ig/insights/nginx-remediation-guide#source-3)[S4](https://keendigit.com/ig/insights/nginx-remediation-guide#source-4) ### 5.1 njikwa okporo ụzọ dị mkpa dabere na mkpughe mpụga Mee ka ụzọ mbenata elu ọgụ nke ọrụ enweghị ike ịkwalite n'oge: n'elu njikwa na ime API Tinye njikwa ịnweta isi mmalite ntụkwasị obi, ikewapụ netwọk elu ma ọ bụ na-anọghị n'ịntanetị dị mkpụmkpụ; tinye njikọ, rịọ ahụ na oke ọnụego na ọnụ ụzọ ndị nwere nnukwu ihe ize ndụ; hụ na nyocha isi mmalite na-apụta na ntinye metụtara NGINX tupu agbụ nhazi arịrịọ. Ekwesiri iburu n'uche na ọtụtụ n'ime adịghị ike n'onwe ha dị na NGINX N'ime ụgbọ elu data, omenala WAF Iwu nwere ike ọ gaghị ekpebi n'ụzọ ziri ezi nhazi nhazi nhazi ọnọdụ. ### 5.2 `alias` / `rewrite`: zere ịtụle `$request_filename` mgbe idegharịchara A na-atụ aro ka ịlele na mezie: - Gbalịa ka ị ghara ime `rewrite` nke ga-agbanwe URI n'otu oge ka `location` jiri `alias`. - Zere iji `$request_filename` mgbe edegharịrị URI mana emechabeghị egwuregwu ọnọdụ ziri ezi. - Lelee nrụtụ aka ndị na-agbanwe agbanwe na-apụtaghị ìhè na `return`, `set`, `if`, `add_header`, nweta usoro ndekọ, ma tinye faịlụ. - Jiri `root`/`try_files`/`location` nke kwụụrụ onwe ya mgbe azụmahịa nyere ikike, mana ọ na-agbanwe naanị `alias` gaa `root`. Ọ nwekwara ike ịgbanwe semantics ụzọ faịlụ, nke a ga-enyocharịrị otu otu. Edeghachila ozugbo "ntụgharị ederede echekwara" na ịntanetị iji degharịa nhazi dị adị. Prefixes `location` dị iche iche na idegharị lekwasịrị anya na-ebute ụzọ n'ụzọ nwere nkọwa dị iche iche. [S5](https://keendigit.com/ig/insights/nginx-remediation-guide#source-5) ### 5.3 `map`/Regex: Belata ngwakọta steeti na-agbanwe agbanwe. A na-atụ aro ka ibu ụzọ weghara ndị akpọrọ aha wee kpachie oke mgbasa ha, kama ikwe ka ejigharị ihe ndị na-amaghị aha dịka `$1` gafee ụzọ nyocha regex dị iche iche ka oge na-aga. Dịka ọmụmaatụ: ```nginx # 演示具名捕获的结构，实际变量名和匹配表达式须按业务调整 map $host $tenant_root { default /srv/www/default; ~^(?[a-z0-9-]+)\.example\.net$ /srv/www/$tenant; } ``` Mpempe akwụkwọ a na-egosipụta naanị usoro dị mfe nyocha nke nwe mgbanwe; apụtaghị na egosipụtara na ọ ga-ewepụ onwe ya kpamkpam CVE-2026-93479 ụzọ na-akpalite. Karịsịa, nyochaa ma ọ bụ `root` ndị ọzọ ma ọ bụ `log_format` na-ezo aka n'ụdị mgbanwe njide tupu oge eruo, yana ma enwere `volatile`, ụzọ dị ike, na ụdọ nyocha na-adabere na ya. F5/CERT na-atụ aro iji njide aha ya na ịmachi oke ojiji na nhazi ndakọrịta oge niile dị ka enyemaka obere oge. [S3](https://keendigit.com/ig/insights/nginx-remediation-guide#source-3)[S6](https://keendigit.com/ig/insights/nginx-remediation-guide#source-6) ### 5.4 AIO + SSI: Mechie nchikota ọrụ na-adịghị mkpa Maka sava/ụzọ na-achọghị SSI ma ọ bụ faịlụ asynchronous I/O, jiri: ```nginx # 在适当的 http/server/location 上下文中配置 ssi off; aio off; ``` Site n'echiche nke adịghị ike na-akpalite ọnọdụ, imechi otu n'ime ha abụọ na-emekarị iji wepụ ihe a kapịrị ọnụ a kọwara; mmechi n'otu oge bụ naanị na ọdabara ọnọdụ ebe azụmahịa anaghị adabere na nke a ike. Lelee `include virtual`, arịrịọ sub, cache, na omume ọdọ mmiri eri; mgbe ibu proxy dị elu, imechi AIO nwere ike ịgbanwe latency na arụmọrụ I/O. [S7](https://keendigit.com/ig/insights/nginx-remediation-guide#source-7) ### 5.5 HTTP/3 Rịọ injection ahụ: mechie ọnụ ụzọ nwa oge ma ọ dị mkpa Gbanyụọ ya `quic` onye na-ege ntị gụnyere HTTP/3 , kagbuo nke `Alt-Svc` nkụnye eji isi mee nke na-ekwupụta HTTP/3 , wee lelee ma akụkụ oyi akwa/load balancer ka na-eziga QUIC na-arịọ ndị na-emezigharịghị ozugbo NGINX : ```nginx # 示意：保留 HTTPS/TCP；暂时移除此前的 QUIC/UDP listen server { listen 443 ssl; # 保留 HTTPS/TCP 入口 # 对支持新版语法的构建，可在此使用 http2 on; # 删除原有的 listen 443 quic reuseport; # 删除原有的 add_header Alt-Svc ...;（仅限宣传 h3 的那项） # 其余证书、server_name、location 等配置保持不变 } ``` Nke a dị n'elu bụ naanị nkọwa nke mgbanwe mgbanwe, ọ bụghị nhazi ihe nkesa zuru oke nke nwere ike ime n'otu n'otu. Ngwakọta ntọala nke HTTP/2 metụtara ụdị NGINX; Ọ bụrụ na ịchọrọ idowe HTTP/2, ị ga-eji `http2 on;` ma ọ bụ syntax dị adị dị ka ụdị kwekọrọ, wee lelee `nginx -t`. ga-ejikọta ya na nhazi ihe nkesa dị adị tupu ebunye ya, kama iji akụkụ a dochie akụkụ ahụ dum. na-enyochakwa UDP 443 firewall, ebe nkwụsị HTTP/3 na ụzọ ọdịda ndị ahịa nke CDN/proxy n'ihu. Ụdị ọzọ nke mbelata oge dị mkpirikpi bụ iji `proxy_request_buffering off;` na emetụta proxy ụzọ, ma nke a ga-agbanwe omume nke upstream arịrịọ ahu gụgharia, ọdịda retries, na ụfọdụ bulite workflows; a ga-eji naanị mgbe nnwale zuru oke na nkwenye na ntuziaka ahụ emetụtara ụzọ proxy HTTP/3 emetụtara. [S8](https://keendigit.com/ig/insights/nginx-remediation-guide#source-8)[S18](https://keendigit.com/ig/insights/nginx-remediation-guide#source-18) ### 5.6 TLS Tiketi nnọkọ: Nchedo izizi mTLS oke nyocha Ọ bụrụ na nkwalite agaghị ekwe omume yana ihe atụ dabere na cache nkekọrịta oge + ntụgharị igodo tiketi akpaka, nyochaa: ```nginx # 在 nginx http/server 适当作用域进行配置 ssl_session_tickets off; ``` Nke a nwere ike gbanyụọ usoro tiketi nnọkọ TLS, si otú ahụ wepụ ụzọ adịgboroja tiketi akọwapụtara na adịghị ike a; agbanyeghị, ọ nwere ike imetụta arụmọrụ mmalite nke oge. Ịnweghị ike gbanyụọ nkwenye ndị ahịa mTLS iji "zere adịghị ike", n'ihi na nke ahụ ga-ehichapụ ókèala mbụ ahụ ozugbo. [S9](https://keendigit.com/ig/insights/nginx-remediation-guide#source-9)[S12](https://keendigit.com/ig/insights/nginx-remediation-guide#source-12) Faịlụ `ssl_session_ticket_key` doro anya yana ntụgharị echekwara echekwabara nwekwara ike iji usoro njikwa TLS ọkachamara wee gafere ọnọdụ ewepụtara akpaaka, mana njide isi, nkesa ọnụ zuru oke, ntụgharị na ogologo ndụ tiketi ochie ga-enyocha nke ọma. A naghị atụ aro ka ị tinye igodo nwere ike ịmegharị ogologo oge na nhazi weebụ ma ọ bụ edemede maka ihe mberede nwa oge. A ga-enyochakwa ọrụ dị oke mkpa nke na-eji mTLS maka omume mweghachi nke oge TLS yana ịjụ arịrịọ na-enweghị ezigbo asambodo ndị ahịa. [S12](https://keendigit.com/ig/insights/nginx-remediation-guide#source-12) ### 5.7 Ọrụ nke sistemụ arụmọrụ yana nchedo oke ```bash # Linux：常见值 2 表示进程地址空间随机化处于完整启用状态 sysctl kernel.randomize_va_space ``` ASLR, ndị ọrụ na-abụghị root, sistemụ faịlụ akpa ndị na-agụ naanị, ikike faịlụ pere mpe na ikewapụ netwọkụ nwere ike ibelata mmetụta RCE nwere ike. ASLR anaghị edozi oke oke oke ma ọ bụ UAF na enweghị ike ikwe nkwa na ndị ọrụ agaghị ada. WAF, oke ọnụego na ịrịọ oke nha ahụ anaghị edozi njikọ igodo tiketi TLS. [S4](https://keendigit.com/ig/insights/nginx-remediation-guide#source-4) ### 5.8 nghọtahie nkịtị: Ọrụ ndị a ezughi oke iji mechaa nrụzi ahụ | Arụ ọrụ nkịtị | Gịnị kpatara na o zughị ezu? | | ---------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------- | | "nginx -v dị ọhụrụ" | Alaka nke ọ nwere, ụdị ngwungwu azụghachi azụ zuru oke nke ụdị ntọhapụ yana usoro ịntanetị anaghị enyocha ya. | | "Ọ bụ naanị otu n'ime intranet ka emelitere" | Ochie Worker/ akpa ochie/ochie CDN mmalite ka na-anata arịrịọ | | "Saịtị anaghị eji PHP/dynamic mkpado" | Nrụrụ ahụ na-apụta na isi ụzọ NGINX ma ọ bụ nyocha protocol na adabereghị na mkpochapụ PHP. | | "Imepe WAF/Cloudflare ezuola" | Enweghị ike ịnwapụta WAF iji gbochie ntụpọ ebe nchekwa dabere na NGINX ma ọ bụ ntụpọ mmalite TLS | | "Emeghela ASLR" | Naanị iji ohere nke mbelata ihe isi ike; DoS nwere ntụtụ arịrịọ ka ga-ekwe omume | | "HTTP/3 adịghị ekpughe na netwọk ọha na eze, yabụ na ọ dịghị mkpa ịkwalite ma ọlị" | CVE anọ ndị ọzọ ka na-achọ nyocha nke onwe; ma enwere ike inwe njikọ kpọmkwem na mmalite zoro ezo | | "Edozie adịghị ike nke July `map`" | Ọktoba CVE-2026-93479 gụnyere okwu nleba anya edemede na-esote | | "Ịkwụsị caching na-edozi nsogbu niile" | Naanị emetụta ụfọdụ TLS cache ma ọ bụ AIO ndapụta, na ọ dịghị ekpuchi utu aha, script, HTTP/3 | ## 6. Official Patch mmejuputa echiche na nyochaa isi Akụkụ a na-esochi ndozi NGINX nke October 2026. Mpempe akwụkwọ ndị ahụ na-egosi mgbanwe nnochite anya maka nlebanya patch; ha ezughị ezu, ndozi na-achịkọta onwe ya. Maka iwulite omenala, nyochaa mmemme zuru oke, koodu gbara ya gburugburu na ule, wee họrọ ntọhapụ akwadoro zuru oke. [S5](https://keendigit.com/ig/insights/nginx-remediation-guide#source-5)[S6](https://keendigit.com/ig/insights/nginx-remediation-guide#source-6)[S7](https://keendigit.com/ig/insights/nginx-remediation-guide#source-7)[S8](https://keendigit.com/ig/insights/nginx-remediation-guide#source-8)[S9](https://keendigit.com/ig/insights/nginx-remediation-guide#source-9) ### Edegharịrị 6.1 CVE-2026-15176: URI ka edegharịrị ka ọ gụnyere ọnọdụ njụta nkewa ụzọ `alias` Ihe mgbago elu emeziri `ngx_http_map_uri_to_path()` na `src/http/ngx_http_core_module.c`: ```diff - if (alias && !r->valid_location) { + if (alias && (!r->valid_location || r->uri_changed)) { ``` lekwasịrị anya nleba anya: Enweghị ike ịga n'ihu na-agbakọ usoro faịlụ faịlụ mgbe URI agbanweela mana ọnụọgụ ọnọdụ nke `alias` enweghịzi ntụkwasị obi. Nke a bụ nkwalite mmachi tupu steeti. Ọ bụghị nlele dị mfe ma arịrịọ URI nwere mkpụrụedemede iwu na-akwadoghị. [S5](https://keendigit.com/ig/insights/nginx-remediation-guide#source-5) ### 6.2 CVE-2026-93479: Kpebie ọdịiche dị n'etiti ogologo data mmepụta na ogologo echekwara Mgbago elu na-emelite `src/http/ngx_http_script.c` na `src/stream/ngx_stream_script.c` n'otu oge. Enwere ike ichikota isi ebumnuche dika: ```diff - n = len; + n = 0; /* ...计算实际脚本输出长度... */ - value->len = n; - value->data = ngx_pnalloc(pool, n); + value->len = n + len; + value->data = ngx_pnalloc(pool, n + len); ``` N'ebe a, `pool` bụ ihe atụ aha oke: n'ezie HTTP na Stream nkenye okwu dị iche. Mgbanwe a na-ebu ụzọ gbakọọ ogologo mmepụta edemede, wee gbakwunye ogologo echekwabara na oke ikpeazụ ka mmepụta ghara idegharị oghere echekwara. [S6](https://keendigit.com/ig/insights/nginx-remediation-guide#source-6) Mgbe ị na-enyocha ma na-atụgharị azụ, onye nyocha HTTP/Stream ga-ekpuchirịrị; naanị ịlele faịlụ syntax nhazi nke `map` enweghị ike igosipụta na edozila ntụpọ ahụ. ### 6.3 CVE-2026-97205: Tọọ ebe nchekwa maka ọnụ ọrụ asynchronous 8-bit Agbakwunyere elu na `src/http/ngx_http_request.h`: ```c #define NGX_HTTP_MAX_BLOCKED 250 ``` Ma tinye ntinye yiri ya na ọgụgụ faịlụ asynchronous, ichere cache, nzacha mmepụta na ọrụ eri: ```c if (r->main->blocked >= NGX_HTTP_MAX_BLOCKED) { /* 使用同步路径，或者拒绝新的异步操作 */ } ``` lekwasịrị anya nyocha: Ụzọ koodu niile ga-agbakwunye `r->main->blocked` ga-ekpuchirịrị. Ịnweghị ike dee ọnụ ụzọ mgbe niile na faịlụ nkụnye eji isi mee. Backport chọkwara ịlele nchikota zuru oke nke ndaghachi azụ mmekọrịta, nzaghachi asynchronous na nloghachi mperi iji hụ na mkpọchi ọnwụ ma ọ bụ ntanye ntụaka agaghị ebute site na ịjụ ọrụ ozugbo. [S7](https://keendigit.com/ig/insights/nginx-remediation-guide#source-7) ### 6.4 CVE-2026-95101: Jikwaa ọkwa `skip` iche maka okpokolo agba amabeghị. Mgbago elu na-agbakwunye ogige `skip` na nhazi ọkwa nke HTTP/3 ma na-eme nkewa ọkwa: ```c if (st->type != NGX_HTTP_V3_FRAME_DATA && st->length > 0) { st->skip = st->length; st->length = 0; st->state = sw_skip; } /* ... */ rc = ngx_http_v3_parse_skip(b, &st->skip); ``` Isi ihe abụghị “ịgbanyụọ okpokolo agba HTTP/3 amaghị ama”, mana iji hụ na n'ofe ọtụtụ agụ, ọnụ ọgụgụ byte ndị awụsara na ogologo ụgwọ ọrụ DATA bụ ndị steeti nọọrọ onwe ha na-achịkwa mgbe niile. Nlebanya kwesịrị ilekwasị anya na Sharding cross-buffer frame amaghi ama, yana ngbanwe nke `client_max_body_size`. [S8](https://keendigit.com/ig/insights/nginx-remediation-guide#source-8) ### 6.5 CVE-2026-97629: Mekọrịta usoro oghere igodo TLS zuru ezu. Mgbanwe ndị dị n'elu dị na `src/event/ngx_event_openssl.c`: ```diff ngx_memcpy(keys->elts, cache->ticket_keys, - 2 * sizeof(ngx_ssl_ticket_key_t)); + keys->nelts * sizeof(ngx_ssl_ticket_key_t)); ``` Onyonyo izizi nwere oghere igodo atọ, mana naanị abụọ mbụ ka e depụtaghachiri. Kama, mekọrịta ya dabere na ọnụ ọgụgụ ihe dị n'usoro iji hụ na usoro igodo ịtụ vootu nke Worker dabara na ebe nchekwa nkekọrịta. Mgbe ị na-enyocha, gosikwa na oke n'usoro, mmalite, mkpọchi mkpọchi na mgbagha na-agbanwe agbanwe, kama ịlele mgbanwe ogologo `memcpy` otu ugboro. [S9](https://keendigit.com/ig/insights/nginx-remediation-guide#source-9) ### 6.6 Gịnị kpatara na anaghị atụ aro ka itinye naanị mperi gbasasịrị agbasasị? Mgbanwe ise ndị a gbasara `src/http`, `src/stream`, `src/http/v3`, na `src/event` n'otu n'otu, na ụdị ochie nwere ike ịnwe nchekwa azụ na ndọtị na-akwadoghị. Ntugharị azụ kwesịrị ịmepụta matriks nlele ndị a: | Lelee ihe | Ihe a ga-ekwenyerịrị | | --------------------- | ------------------------------------------------------------------------------------- | | isi iyi | Nrubeisi nke gọọmentị, ụdị ebumnuche dabara, patch zuru oke na nkwenye mbinye aka | | Ntọala patch izizi | Anaghị emegide mgbanwe akụkọ ihe mere eme dịka CVE-2026-42533, nkesa azụ azụ, wdg. | | ụzọ koodu | HTTP + Stream script, AIO/eriri, HTTP/3, OpenSSL Tiketi ekpuchirila. | | Ejikọtara dakọtara | OpenSSL, PCRE, modul ABI, modul ike na ndabere njikọ na-agbanwe agbanwe. | | arụ ọrụ ndọghachi azụ | `alias` degharịa, ndekọ ike, SSI/AIO, HTTP/3 bulite, mTLS mmalite mmalite. | | oge ojiri gaa | Worker/Pods niile na-arụ ụlọ ọhụrụ enwetara nke ọma, ọ nweghị ihe oyiyi ọ bụla fọdụrụ | Maka otu ndị na-ejigide mwepụta nke ha, a na-atụ aro ka idobe ID patch, ụdị ngwugwu, wuo ndekọ, na akụkọ nkwụghachi azụ maka CVE ọ bụla; maka ịrụ ọrụ na nrụzi nkịtị, ihe ngwọta kachasị mma bụ ịwụnye mmelite nchekwa zuru oke nke onye na-ere ahịa. ## 7. Ihe ọghọm akụkọ ihe mere eme azụ azụ, alaka ochie na ngwaahịa ndị ọzọ ### 7.1 NGINX isi adịghị ike kwesịrị nkwenye n'otu oge site na Mee ruo Septemba 2026 Ọtụtụ NGINX nke emelitebeghị ogologo oge abụghị naanị okwu ọhụrụ na-emetụta na Ọktọba. Ndị a bụ ọnụ ọnụ nrụzi ndị nnọchite anya n'ọdịnihu dị nso: [S1](https://keendigit.com/ig/insights/nginx-remediation-guide#source-1)[S2](https://keendigit.com/ig/insights/nginx-remediation-guide#source-2) | CVE | Mwepụta mbụ idozi | Ihe egwu dị mkpa na ọnọdụ chọrọ nyocha | | -------------- | -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- | | CVE-2026-42945 | Stable 1.30.1 / Mainline 1.31.0, Mee 13 | `rewrite` Anonymous regex njide na mgbagha nnọchi na-akpalite oke oke, nwere ike RCE; enwere akụkọ ọhaneze maka mbọ mwakpo n'ime ọhịa | | CVE-2026-9256 | Stable 1.30.2 / Mainline 1.31.1, Mee 22 | Mkpokọta regex na nleba anya ogologo na `rewrite` na-eduga na njupụta. | | CVE-2026-42055 | Stable 1.30.3 / Mainline 1.31.2, Juun 17 | HTTP/2 Nhazi akọwapụtara maka elu ma ọ bụ gRPC, nnukwu ọnọdụ nkụnye eji isi mee na-akpalite oke oke. | | CVE-2026-42530 | Mainline 1.31.2, Juun 17 | HTTP/3 Jiri-N'efu; akara ngosi emetụtara nso `1.31.0–1.31.1` | | CVE-2026-42533 | Stable 1.30.4 / Mainline 1.31.3, Julaị 15 | `map` + regex njide ntule mgbanwe na-ebute oke oke oke, na patches sochirinụ nwere njikọ regression na CVE-2026-93479 na Ọktọba. | | CVE-2026-60005 | Stable 1.30.4 / Mainline 1.31.3, Julaị 15 | `ngx_http_slice_module` ọdịnaya ebe nchekwa gbapụrụ n'okpuru ọnọdụ mgbanwe dị iche iche yana mmelite cache | | CVE-2026-56434 | Stable 1.30.4 / Mainline 1.31.3, Julaị 15 | SSI metụtara UAF; Ọ bụghị otu root kpatara dị ka October's AIO agụta adịghị ike. | | CVE-2026-90439 | Stable 1.30.5 / Mainline 1.31.6, Septemba 15 | Oke oke oke oke nke HTTP/3 + kpọmkwem ụdị ụdị OpenSSL, gosipụtara nke ọma dị ka nrụrụ aka nke mkpọka/oke ebe nchekwa. | A ga-enyochakwa adịghị ike ndị ọzọ dị ka NGINX Core, HTTP/2, charset, na SMTP ekwuputara na 2026 dịka akwụkwọ akụkọ nchekwa gọọmentị siri kwuo; Tebụlụ a kpachaara anya lekwasị anya n'ihe omume ndị kachasị mkpa na nke ugbu a NGINX ihu ọha na-eche ihu proxy deployments ma nwee nchekwa ebe nchekwa ma ọ bụ rịọ mmetụta iguzosi ike n'ezi ihe. abụghị CVE niile na 2026. Ndepụta. [S1](https://keendigit.com/ig/insights/nginx-remediation-guide#source-1) #### Kedu ihe kpatara ị ga-eji lebara CVE-2026-42945 anya pụrụ iche Enwere akwụkwọ akụkọ nchekwa sitere na ụlọ ọrụ gọọmentị na-edekọ ihe omume irigbu n'ime ọhịa yana ozi koodu nrigbu ọha maka adịghị ike `rewrite` a na Mee. Ya mere, n'ihi na ihe atụ na-adịghị patched ogologo oge site na May ruo ugbu a na-emeghe mgbagwoju mgbe okwu rewrite na ọha netwọk, na mgbakwunye na-emecha mmezi, na-adịghị ahụkebe Worker mkpọku, ohere ndekọ na-enyo enyo mgbanwe n'oge ahụ kwesịrị ọzọ enyocha. [S23](https://keendigit.com/ig/insights/nginx-remediation-guide#source-23) "Mgbalị mbuso agha mere" anaghị egosi ozugbo na onye mwakpo ahụ ejirila ntụkwasị obi mee iwu na ebumnuche ọ bụla; mgbe ọ metụtara nzaghachi ihe merenụ, ekwesịrị inyocha ihe nrịba ama nbibi na mkpọka usoro dị iche iche site na ezigbo ihe akaebe nke mmụba ma ọ bụ nnọgidesi ike. ### Ndozi 7.2 maka ụdị ochie na nkesa azụ azụ NGINX Alaka dị iche iche nwere usoro nkwado nke ha yana oge mmeghe adịghị ike dị iche iche. Enweghị ike ịfesa patches ise ọhụrụ ahụ n'osisi ndị mbụ na-enweghị nyocha. | ọnọdụ | Atụmatụ akwadoro | | ------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Ụdị mwepụta ekwupụtala patches nche zuru oke | Jiri ngwungwu ndị na-ere ahịa wee detuo ụdị ngwugwu zuru oke; zere iji ọnụọgụ abụọ efu na-adabaghị adaba dochie anya | | Debian 12 na mwepụta ndị ọzọ metụtara nke CVE niile na-ekpuchibeghị na ogbe a. | Nyefee iwu ọrụ ihe egwu, kpachie mkpughe mpụga, wee lelee ọkwa ndị na-eweta ngwaahịa/ELTS; kwaga mba ọzọ ma ọ bụ jiri ụdọ ntọhapụ arụkwaghị ekwenye mgbe ọ dị mkpa | | Alaka akụkọ ihe mere eme kwụsịrị nkwado mgbago elu | Dozie mbugharị na ụdị akwadoro ụzọ; ọ bụrụ na ọ dị mkpa n'azụ obere oge, ndị na-elekọta ga-enyocha ihe ndabere na ndakọrịta, wee dee ule zuru oke. | | Na-abịa na ndụdụ NGINX (OpenResty, Tengine, ọnụ ụzọ ahaziri ahazi) | Buru ụzọ chọpụta ma etinyere ụzọ koodu kwekọrọ, wee jiri nkwupụta nchekwa onye nchekwa ndụdụ. Ọ nweghị ike ịha nhata ozugbo na ụdị elu. | | Ihe nkpuchi nche na-eduga na mgbanwe na ọrụ azụmahịa | Nabata usoro mgbasa ozi akwadoro, ntụgharị okporo ụzọ n'etiti ụdị, yana nhazi nhazi; ọ bụghị ihe kwesịrị ekwesị iweghachi ụdị nke netwọk ọha na-enweghị nkewa. | ### 7.3 mmezi iche maka njs, Ingress na NGINX Core - njs: Na mgbakwunye na mmemme bụ isi NGINX, ị ga-achọkwa ịlele ụdị nke NGINX Javascript modul n'onwe ya. `njs 1.0.2` na-edozi ike ọgwụgwụ ebe nchekwa XML nke Ọktọba 2026 yana okwu nnabata XML nwere njiri mara ihe. Maka mbugharị ejikọtara na nkwenye mbinye aka XML site na iji `nginx-saml`, ị ga-agụrịrị ntuziaka njs gọọmentị maka ihe ndapụta nkwụnye. [S20](https://keendigit.com/ig/insights/nginx-remediation-guide#source-20) - F5 NGINX Plus / NGINX Ingress Controller: Plus, njikwa na ọnụ ụzọ ámá Fabric nwere ike onye ọ bụla nwere agbakwunyere akwụkwọ akụkọ nche, ụdị nkwakọ ngwaahịa dị iche iche na adịghị ike amụma pụrụ iche. Ịkwalite otu oyi akwa apụtaghị imelite oyi akwa ọzọ ozugbo. [S19](https://keendigit.com/ig/insights/nginx-remediation-guide#source-19) - Kubernetes Community ingress-nginx: Ndị ọrụ Kubernetes ekwupụtalarị na onye njikwa ahụ kwụsịrị ịrụzi ya na Machị 2026, ụlọ nkwakọba ihe ya enweghịkwa mgbagwoju anya na onye njikwa F5. Azụmaahịa emetụtara kwesịrị ịhazi njem dị nro ma nyochaa nkọwa Ingress yana ọdịiche ntụgharị Gateway API kama ichere ụdị nchekwa ọhụrụ. [S21](https://keendigit.com/ig/insights/nginx-remediation-guide#source-21) ## 8. Usoro nnabata na nleba anya nleba anya A na-atụ aro ka ejiri ndepụta ndị a dị ka ọnọdụ nnabata maka mgbanwe iwu ọrụ: | Ihe oru ngo | Ụkpụrụ ntozu | Ihe akaebe enwere ike idowe | | ----------------------------- | ------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------- | | Ihe onwunwe na mkpuchi portal | Achọpụtala ihe ngosi niile dị na mpụga na nke nwere ike ịgafe CDN. | Aha ngalaba, LB, IP, Ndekọ pọd/akpa | | Ebe ngwugwu na oke nrụzi | Jiri ụdị akwadoro iji kpuchie CVE niile dị | Ndụmọdụ nchekwa dị elu, USN/DSA, ụdị ngwugwu, mgbari onyonyo | | usoro ochie na-apụ apụ | All ochie master/worker/container ka edochiela. | PID/oge mmalite, ọkwa mbugharị, onyonyo na-agba ọsọ | | Nyocha nhazi | E wepụrụ ma ọ bụ kpuchie nchikota ndị nwere nnukwu ihe ize ndụ, ma enyochala mmekọrịta nketa | hazigharịrị nchịkọta na ndekọ nyocha nke `nginx -T` | | TLS/mTLS | Asambodo ntụkwasị obi gafere; Ajụjụ asambodo ezighi ezi ma ọ bụ na-efu; mweghachi nke oge anaghị agafe nyocha | Nnwale ikike na-adịghị mma/nke ziri ezi, nsonaazụ ule TLS na-achịkwa | | HTTP/3 ahụ arịrịọ | Kwado ụzọ edoziri; elu arịrịọ ahu na throttling na-akpa àgwà nke ọma | HTTP/3, bulite proxy, ule mgbagha oke olu | | SSI/AIO | Ọrụ ahụ na-emezu ihe achọrọ, Worker enweghị ime ime na-adịghị mma | Mweghachi azụmaahịa, nleba anya ọnụego mkpọka na njehie | | Ọrụ na nlekota oru | Ọ nweghị ihe doro anya 5xx, SIGSEGV, usoro na-apụ ugboro ugboro | Ihe ngosi ọrụ na ndekọ tupu na mgbe mgbanwe gasịrị | | Atụmatụ nlọghachi azụ | Ọ bụrụ na nlọghachi azụ dị mkpa, buru ụzọ kpachie mkpughe ma chekwaa oke nchekwa | Gbanwee iwu, usoro ihe mberede, yana atụmatụ iche iche | | okirikiri ndụ ọzọ | Kpebie ndebanye aha akwụkwọ akụkọ nchekwa, ugboro mmelite akpa, yana atụmatụ mbugharị alaka ụlọ ọrụ | Nweta nkwalite akwụkwọ akụkọ, onye nwere ọrụ na ụbọchị nyocha ọzọ | ### 8.1 Kedu ihe ị ga-elekwasị anya na ndekọ ndekọ na ọkwa ọsọ? Nchọpụta nsogbu na sava nke ekpughere ogologo oge `worker process exited on signal` , `SIGSEGV` , arịrịọ ọdịda spikes, abnormal source access aggregation, na-atụghị anya TLS nnọkọ resumption/authentication azụ azụ omume na abnor omume. Enwere ike iji ihe ngosi ndị a naanị dị ka ihe nleba anya nyocha ma ha abụghị ihe akaebe zuru oke iji gosi ozugbo na erigbula ụfọdụ CVE. ;Enweghị ndekọ dị mkpa adịghị egosi na ọ dịbeghị ọgụ. ### 8.2 kwadoro okwu mmechi ihe egwu ikpeazụ Akụkọ nnabata maka gburugburu mmepụta kwesịrị iji okwu ziri ezi na-esonụ: > NGINX Achọpụtala ọnụ ụzọ ọrụ mpụga na ebe ngwugwu ngwanrọ. Ebulila ikpe niile dabara adaba na ụdị nchekwa gọọmentị dị n'elu, ma ọ bụ n'azụ azụta nke onye na-ere ntọhapụ kwadoro; ochie Worker e dochiela arịa ochie. Aha aha/degharịa/map, AIO / SSI , HTTP/3 arịrịọ ahu na TLS Tiketi nnọkọ/ mTLS enyochala nhazi ndị metụtara ya wee gafee arụ ọrụ, nyocha na ịrịọ maka nlegharị anya nkwụsi ike. Maka oge emechabeghị nkwalite ahụ, debanye aha mpaghara mkpughe, usoro nkwụghachi ụgwọ, ndị nwere ọrụ na oge imecha. Ọ bụrụ na patch maka Debian 12 ma ọ bụ ntọhapụ ndị ọzọ ka ezughị oke, ọ bụghị ihe kwesịrị ekwesị ikpe ụdị nnabata niile dịka "emezuru"; CVE a na-edozighị, ma enwere nhazi ihe na-akpalite kwekọrọ, ọnọdụ dịpụrụ adịpụ na ụzọ nkwalite ikpeazụ kwesịrị ka edekọ nke ọma. *** ## Ihe mgbakwunye: isi mmalite na njikọ ndị edepụtara Nkọwa: Nọmba `[Sx]` dị na ederede dabara na ngalaba a. Ihe ndị a na-ebute ụzọ maka ọkwa nchekwa ọrụ elu, ntinye koodu, ọkwa mwepụta ndị na-ebubata ya na ozi ụlọ ọrụ nchekwa obodo. A kọwapụtara ịdị njọ nke adịghị ike ndị e hotara dịka njiri mara ọkwa nke nzukọ ọ bụla na-enye; Ụbọchị nkwenye data bụ Ọktoba 27, 2026. ### S1 — NGINX Open Source akwụkwọ akụkọ nchekwa gọọmentị - Nwere ụdị emetụtara n'elu, na-edozi alaka, yana ọkwa dị njọ nke CVE ise Ọktọba, ma kpuchiekwa adịghị ike akụkọ ihe mere eme site na 2026. ### S2 — NGINX ndekọ mwepụta gọọmentị - - Kwenye 1.30.6 / 1.31.7 nke 2026-10-14, 1.31.8 nke 2026-10-21, yana nnukwu nchekwa ntọhapụ site na Mee ruo Septemba. ### S3 - Cyber ​​Security Agency nke Singapore: F5 NGINX adịghị ike atọ dị egwu. - Nkọwa nke akara CVSS v4.0 9.2, ọnọdụ nhazi achọrọ, yana ntụnye mbelata nwa oge maka CVE-2026-15176, CVE-2026-93479, na CVE-2026-97205. ### S4 - NHS England: F5 NGINX Ndụmọdụ ihe egwu dị elu - Na-akọwa mmetụta DoS / nwere ike RCE nke nsogbu nchekwa nchekwa, yana ihe mgbochi dịka ịgbanyụ ma ọ bụ gafere ASLR. ### S5 — Isi mmalite na-eme: CVE-2026-15176 - Dakọtara na nlele ọkwa nke `alias` na `r->uri_changed` na `ngx_http_map_uri_to_path()`. ### S6 — isi iyi nke enyere: CVE-2026-93479 - Dakọtara na ogologo ederede HTTP/Stream yana mgbagha oke nchekwa echekwara. ### S7 - isi mmalite na-eme: CVE-2026-97205 - Dakọtara na ọnụ ụzọ ọnụ ọgụgụ `r->main->blocked` `NGX_HTTP_MAX_BLOCKED 250` yana ụzọ asynchronous ndaghachi azụ. ### S8 - isi mmalite na-eme: CVE-2026-95101 - Nkewa nke ọkwa dabara na HTTP/3 amaghi ama okpokolo agba fọdụrụ na DATA na-arịọ ogologo ahụ. ### S9 — Isi mmalite na-eme: CVE-2026-97629 - Dakọtara na oghere igodo niile n'oge mmekọrịta TLS ntụgharị tiketi nnọkọ. ### S10 — F5: CVE-2026-15176 Nkwuputa nke onye na-ere ahịa - Depụta ihe na-akpalite dị ka `alias`, `rewrite`, `$request_filename` na ịnweta ndekọ. ### S11 — F5: CVE-2026-93479 ọkwa ọkwa onye na-ere ahịa - Depụta maapụ regex regex, ụzọ root, yana ọnọdụ nyocha mgbanwe ndekọ. ### S12 - NGINX akwụkwọ ikike TLS/SSL akwụkwọ modul - Nkọwa `ssl_session_cache`, `ssl_session_tickets`, `ssl_session_ticket_key` na nyocha akwụkwọ ndị ahịa na ntuziaka ndị ọzọ. ### S13 — Ndụmọdụ nchekwa: Ubuntu USN-8955-1 (2026-10-26) - Nye ụdị ngwungwu ngwanrọ zuru oke na oke nkesa nke Ubuntu 22.04 / 24.04 / 26.04 / 26.10. ### S14 — Ndụmọdụ nchekwa: Debian DSA-6575-1 (2026-10-21) - Kwado ngwungwu ndozi nchekwa `1.26.3-3+deb13u10` maka Debian 13/trixie, wee dekọọ ọgbakọ azụ azụ maka CVE-2026-93479. ### S15 — Nleba anya adịghị ike: Debian Security Tracker: CVE-2026-15176 - Eji iji nyochaa ọkwa ndozi nkesa nke Debian 12 / bookworm na Debian 13 / trixie. Ọkwa a nwere ike ịgbanwe site na mmelite nchekwa n'ọdịnihu. ### S16 — Nleba anya adịghị ike: Debian Security Tracker: CVE-2026-95101 - Nkwenye mgbakwunye nke ọnọdụ nchekwa nke adịghị ike HTTP/3 na ngalaba Debian dị iche iche. ### S17 — Ndụmọdụ nchekwa: Red Hat: CVE-2026-93479 - Nghọta mgbakwunye nke njikọ dị n'etiti adịghị ike nkwụghachi azụ nke Ọktọba yana ndozi maka July CVE-2026-42533. ### S18 - NGINX akwụkwọ ikike reverse proxy modul akwụkwọ - - Jụọ ihe ọmụmụ na ụkpụrụ ndabara nke nhazi dịka `proxy_request_buffering`, `client_max_body_size`, `alias`, `aio`, wdg. ### S19 - NGINX Plus ndetu mwepụta gọọmentị - List Plus CR/LTS alaka, ụdị, patches na kwalite ndakọrịta ncheta. ### S20 — NGINX JavaScript / njs akwụkwọ akụkọ nchekwa gọọmentị - - Nwere Ọktoba 2026 njs 1.0.2 yana nkwado XML metụtara, okwu ike ọgwụgwụ ebe nchekwa. ### S21 - Kubernetes: Community ingress-nginx ntụziaka ezumike nka gọọmentị - - Rịba ama na oru ngo ahụ kwụsịrị mwepụta ọhụrụ yana ndozi nchekwa na Machị 2026, a na-atụ aro ka ịkwaga onye njikwa echekwara ma ọ bụ Gateway API. ### S22 - NGINX njikwa ọrụ gọọmentị yana ntuziaka nkwalite ọnụọgụ abụọ n'ịntanetị - Chọpụta nbugharị nhazi, malitegharịa na usoro nkwalite faịlụ nwere ike ime n'ịntanetị maka ngbanwe nnabata. ### S23 - ọkwa nchekwa gọọmentị: Mee 2026 NGINX degharịa adịghị ike - - Nye ndabere ihe egwu akụkọ ihe mere eme na ntụnye mmelite nchekwa maka CVE-2026-42945; ikpe ndị metụtara nrigbu n'ime ọhịa kwesịrị ịdabere na ọkwa ụlọ ọrụ n'oge ahụ yana ihe akaebe ọzọ merenụ. ### S24 — F5: CVE-2026-95101 na CVE-2026-97629 ọkwa ndị na-ere ahịa - - Na-ekpuchi ihe egwu dị na arịrịọ HTTP/3 ịrịọ mmịnye ahụ yana ntụgharị igodo tiketi akpaaka TLS n'otu n'otu. ### S25 — F5: CVE-2026-97205 Nkwuputa nke onye na-ere ahịa - Nkọwa SSI/AIO na-ebute ọnọdụ yana ihe egwu nrụrụ ebe nchekwa nwere ike. [NGINX nwelite nche: nlele nhazi, nkwalite na nkwenye](https://keendigit.com/ig/news/nginx-security-update) ## Ndụmọdụ nlekọta nchekwa Amaghị ka mgbanwe ntụkwasị obi asambodo si emetụta sistemụ gị? Anyị nwere ike inye aka nyochaa ndị ahịa emetụtara wee hazie mmelite nchekwa. [Kwurịtara mmelite nchekwa]() [Ibe izizi]() · [Ndekọ ọdịnaya]() KeenDigit LLC · Wyoming ntinye akwụkwọ ID: 2026-002106155 [Nyochaa ya na odeakwụkwọ steeti Wyoming]() © 2026 KeenDigit LLC · Sheridan, Wyoming, Njikota Obodo Amerika · Edebere ikike niile.