Affected Systems

NGINX versions 0.1.29 to 1.31.6 (varies by CVE). Five vulnerabilities affect specific configurations: CVE-2026-15176 (alias + rewrite, since 0.1.29), CVE-2026-93479 (regex map, 1.30.0+), CVE-2026-97205 (AIO + SSI, 0.8.11+), CVE-2026-95101 (HTTP/3, 1.25.0+), CVE-2026-97629 (TLS session cache, 1.23.2+). Only servers with specific directives enabled are vulnerable.

Exploitation Status

No active exploitation reported. Not listed in CISA KEV catalog as of October 15, 2026. F5 and NGINX report no attacks. No public PoC mentioned. NGINX rates all five as medium severity; F5 scores three memory bugs 9.2 (Critical CVSS v4.0).

Business Impact

Memory corruption bugs (CVE-2026-15176, CVE-2026-93479, CVE-2026-97205) could crash worker processes or enable remote code execution if specific NGINX configurations are active. TLS flaw (CVE-2026-97629) may allow non-deterministic session forgery to bypass client certificate verification on servers using shared session cache with automatic key rotation. HTTP/3 flaw (CVE-2026-95101) permits request smuggling of extra bytes to backend servers. Impact limited to environments using affected directives (alias+rewrite, regex maps, AIO+SSI, shared TLS cache, or HTTP/3). One flaw (CVE-2026-15176) has existed since May 2005.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Upgrade NGINX to version 1.30.6 (stable branch) or 1.31.7 (mainline branch) immediately if running affected versions with vulnerable configurations
  • Audit NGINX configurations for exposed directives: alias with rewrite and $request_filename, regex maps with captures in root/log_format, aio with SSI includes, ssl_session_cache shared without ssl_session_ticket_key, or HTTP/3 enabled
  • Apply configuration workarounds if immediate patching is not feasible: remove alias or $request_filename usage (CVE-2026-15176), use named captures only (CVE-2026-93479), disable aio or SSI (CVE-2026-97205), set proxy_request_buffering off (CVE-2026-95101), load TLS keys from file or remove shared cache (CVE-2026-97629)
  • Monitor NGINX error logs for worker process crashes or unexpected behavior that may indicate exploitation attempts
  • Review TLS client certificate authentication implementations for anomalous session resumption patterns if using shared session cache