NGINX patches five flaws including possible remote code execution and a TLS client-certificate bypass

F5 released NGINX 1.30.6 and 1.31.7 on October 14 to fix five flaws it rates medium. Three memory bugs, CVE-2026-15176, CVE-2026-93479, and CVE-2026-97205, carry a grouped 9.2 score and could crash a worker process or possibly allow code execution, each requiring a specific configuration. CVE-2026-97629, rated 8.3, is a TLS session ticket key flaw that left a key slot uninitialized after rotation, allowing a forged session that could bypass client-certificate verification on servers using a shared SSL session cache without a defined ticket key. A fifth flaw passes extra HTTP/3 bytes to the backend. None are known to be exploited.

Check

Upgrade NGINX to 1.30.6 or 1.31.7, and on servers using a shared SSL session cache either define a session ticket key file or disable session tickets.

Affected

Affected NGINX versions carry memory bugs that may allow code execution in specific configurations and a TLS flaw that can forge sessions and bypass client-certificate checks.

Fix

Apply the fixed NGINX builds, add an explicit session ticket key or remove the shared cache directive, and confirm distribution packages have backported the patches.