NGINX October 2026 Vulnerabilities: Check Your Config and Patch

Last updated: 24 October 2026. Sources are listed at the end.

On 14 October 2026, the nginx team released 1.31.7 (mainline) and 1.30.6 (stable). These versions fix five NGINX vulnerabilities. Social media posts call three of them “critical” and say attackers can “take control” of a third of the web. The reality is more useful: the bugs are real, but each one needs a specific configuration. This guide shows how to check your config in five minutes and how to patch.

The short answer

• Update to nginx 1.30.6 or 1.31.7 (or later), or to your distribution’s fixed package.
• Check your config for alias, aio, ssi and regex map blocks. If you use none of them, the three serious bugs can’t reach you.
• Don’t panic about “RCE”. The realistic impact is a crashed worker process. F5 says code execution needs ASLR to be off or bypassed.

What the five NGINX vulnerabilities are

The nginx project rates all five as Medium. However, F5 gives the three memory bugs a CVSS v4 score of 9.2, which is where the “critical” label comes from. CVE-2026-93479 is a regression from July’s fix for CVE-2026-42533, so the old 1.28 branch is not affected by that one.

Importantly, no exploitation or public proof of concept had been reported when we checked. Still, nginx bugs get attention fast. In May, “NGINX Rift” (CVE-2026-42945) had a working exploit within days.

Step 1: Check your version and modules

# Version
nginx -v

# Is the HTTP/3 module compiled in? (only matters for CVE-2026-95101)
nginx -V 2>&1 | grep -o -- '--with-http_v3_module' || echo "no HTTP/3 module"

# Distribution package version (Debian/Ubuntu)
dpkg -l 'nginx*' | awk '/^ii/{print $2, $3}'

Remember that distributions backport fixes. So a package can show an older version number and still be patched. Compare the full package version with your vendor’s security tracker.

Step 2: Audit your config for the risky directives

The nginx -T command prints your full configuration, including every included file. Then you can search it:

# Directives that the three serious bugs depend on
sudo nginx -T 2>/dev/null | grep -nE '^\s*(alias|aio|ssi)\s|request_filename|\$[1-9]'

# Regex lines inside map blocks
sudo nginx -T 2>/dev/null | grep -nE '^\s*~'

# HTTP/3 listeners and client-certificate checks
sudo nginx -T 2>/dev/null | grep -nE 'listen .*quic|ssl_verify_client|ssl_session_ticket'

We tested these commands on a sample config. They flagged an alias with a rewrite and $request_filename, a regex map using $1, and a location with ssi on plus aio threads. Read each match in context: a hit means “look closer”, not “you are vulnerable”.

Step 3: Patch

Debian and Ubuntu

sudo apt update && sudo apt install --only-upgrade nginx nginx-common
sudo nginx -t && sudo systemctl reload nginx

Debian 13 (trixie) has a fix in 1.26.3-3+deb13u10 (DSA-6575-1). On the other hand, Debian 12 (bookworm) was still marked vulnerable on 24 October. Ubuntu had not shipped fixed packages yet when we checked. If your vendor has no fix, use the official nginx.org repository or the workarounds below.

RHEL, AlmaLinux and Rocky

sudo dnf upgrade nginx
rpm -q nginx
sudo nginx -t && sudo systemctl reload nginx

Docker

Rebuild on a fixed tag such as nginx:1.30.6-alpine or a current mainline tag, then redeploy. Updating the host does nothing for nginx inside a container.

NGINX Plus and F5 products

NGINX Plus R33 to R37, NGINX Ingress Controller 5.6.0–5.6.3 and several other F5 products are affected. Check F5 advisories K000162416, K000162607 and K000162608 for your fixed release.

Workarounds if you can’t patch today

• CVE-2026-15176: avoid alias together with $request_filename in the same location, or switch that location to root.
• CVE-2026-93479: use named captures ((?<name>...)) instead of $1 in regex maps.
• CVE-2026-97205: turn off aio or SSI where you don’t need them.
• CVE-2026-95101: set proxy_request_buffering off on HTTP/3 servers, or disable the quic listener for now.
• CVE-2026-97629: set your own ssl_session_ticket_key, or ssl_session_tickets off.
• Keep ASLR on. cat /proc/sys/kernel/randomize_va_space should print 2.

Is the HTTP/3 “crash 7 of 10 servers” story the same thing?

No. That claim comes from separate research by FoxIO, published on 20 October, about QPACK header amplification. It tested HTTP/3 libraries, such as quic-go (used by Caddy and Traefik), Cloudflare quiche and lsquic. NGINX was not among the ten. If you run Caddy or Traefik, update them to builds with quic-go 0.57.0 or later.

Quick checklist

• ☐ Found every nginx install (servers, containers, ingress controllers)
• ☐ Checked versions against 1.30.6 / 1.31.7 or the vendor’s fixed package
• ☐ Searched configs for alias, aio, ssi and regex maps
• ☐ Patched, ran nginx -t and reloaded
• ☐ Applied workarounds where no fix exists yet

For a broader review, use our free Linux server hardening checklist. This release landed in a very busy month; see our Black October fact-check and our PHP2Shell patching guide for the other big server bug.

Sources

• nginx security advisories
• nginx news: 1.31.7 and 1.30.6 releases
• The Hacker News: NGINX fixes five flaws
• CSA Singapore alert AL-2026-150
• Debian security tracker: CVE-2026-15176
• FoxIO: QPACK amplification attacks against HTTP/3 servers

Running nginx in production? Our Linux server hardening & security audit reviews web server configs, patching and TLS. You can also start with our free Linux server hardening checklist, or contact us.