On 14 October 2026 nginx shipped 1.31.7 on the mainline branch and 1.30.6 on the stable branch - a security release closing five medium-severity CVEs at once.[1][2] If you skimmed the changelog when the kernel of your reverse proxy last updated, this is the one to read in full: together these fixes cover alias + rewrite buffer overflows, string-expression evaluation in root/logging paths, HTTP/3 request-body injection, forged TLS sessions via ticket-key rotation, and a use-after-free in AIO/SSI. They affect widely different configs, so “am I impacted?” is not a single yes/no - it depends on which of five paths your nginx actually runs.

This is the follow-up to our 1.31.6 HTTP/3 security guide - that release already pointed you here with an update callout, and it remains the reference for CVE-2026-90439 (heap overflow in HTTP/3 with OpenSSL ≤ 3.5.0). What follows covers the new batch, how to check whether your host is in scope for each one, and the upgrade that closes all five in a single move.

What 1.31.7 / 1.30.6 actually fix

All five are rated medium severity on the nginx advisories page.[2] None of them crosses into the control plane - these are all data-plane, worker-process issues - but four are remotely reachable on a normally configured server, and two warrant immediate attention because they sit in paths most reverse proxies run by default. Here’s each one, precisely stated.

CVE-2026-15176 - buffer overflow in alias + rewrite

A buffer overflow can occur in a worker process when a location has alias and the request URI is changed by rewrite before being mapped to a file path - for example when $request_filename is used in an access log format or in a set/return after a rewrite.[3] The CVE record is explicit that the conditions are partly “beyond the attacker’s control,” and the practical impact is a worker-process restart (DoS); code execution is only conceivable on systems where ASLR is disabled or bypassable.[3]

  • Vulnerable: nginx 0.1.29–1.31.6.[2]
  • Scope narrows to: configs that combine alias with rewrite (or with set/return referencing $request_filename). A stock proxy_pass reverse proxy without alias doesn’t run this path.

CVE-2026-93479 - buffer overflow in string-expression evaluation

A buffer overflow can occur while nginx evaluates string expressions with variables - which affects the document root calculation and request logging in the http and stream modules.[1][4] This is the newest class of the batch: it only exists in the 1.31.2–1.31.6 mainline window and its stable mirror, so anything older or newer is out of scope.

  • Vulnerable: mainline 1.31.2–1.31.6; stable 1.30.0–1.30.5.[2]
  • Scope narrows to: configs that compute root from a variable or log string expressions containing variables. Plain, literal root /var/www/html; paths don’t hit it.

CVE-2026-95101 - HTTP/3: unknown frame treated as request body

When using HTTP/3 with proxy_request_buffering on;, a part of an unknown frame can be treated as the request body - which lets a remote attacker bypass client_max_body_size or inject data into a proxied request.[1][5] This is the one with a published CVSS score: 5.3 MEDIUM (CVSS 3.1, AV:N/AC:L/PR:N/UI:N/...) and 6.9 MEDIUM (CVSS 4.0), per the cve.org record.[5]

  • Vulnerable: nginx 1.25.0–1.31.6 (any build with HTTP/3 enabled).[2]
  • Scope narrows to: builds with --with-http_v3_module that actually serve listen ... quic. If you don’t speak HTTP/3, this specific CVE can’t reach you.

CVE-2026-97629 - forged TLS session via ticket-key rotation

When TLS session ticket key rotation is configured (the automatic rotation path - ssl_session_cache shared:... without an explicit ssl_session_ticket_key), one of the rotation keys is left uninitialized, allowing an attacker to forge a client SSL session and potentially bypass verification of client certificates.[6]

  • Vulnerable: nginx 1.23.2–1.31.6.[2]
  • Scope narrows to: TLS servers that rely on automatic session-ticket key rotation - i.e. a ssl_session_cache shared: directive present and no ssl_session_ticket_key directive. If you set your own ssl_session_ticket_key, the vulnerable automatic-rotation path isn’t the one running.

CVE-2026-97205 - use-after-free in AIO + SSI

When asynchronous file I/O (AIO) is enabled and an SSI page contains include virtual commands, processing can hit a use-after-free in the worker process - memory corruption or a crash.[1][7]

  • Vulnerable: nginx 0.8.11–1.31.6.[2]
  • Scope narrows to: servers running aio on; (or aio threads;) and serving SSI pages that use include virtual. Both are uncommon separately and rarer together, but this is the widest affected range in the batch.

Am I affected? Answer it per-config, not per-server

Because the five CVEs live in different directives, the right check is a single grep pass across your config directory, then look at which hits you actually have. Run these on every host that runs nginx (including stream-module configs, which matter for CVE-2026-93479):

nginx -v
# nginx version: nginx/1.31.6   → in scope for all five
# nginx version: nginx/1.30.5   → in scope; upgrade to 1.30.6 (stable)
# nginx version: nginx/1.31.7   → patched

echo "--- alias + rewrite ($request_filename) [CVE-2026-15176]"
grep -rnE 'alias|rewrite|request_filename' /etc/nginx/

echo "--- variable-based root / access-log strings [CVE-2026-93479]"
grep -rnE 'root\s+\$|log_format.*\$|access_log.*\$' /etc/nginx/

echo "--- HTTP/3 listeners [CVE-2026-95101]"
grep -rnE 'listen .*(quic|http3)|http3 on' /etc/nginx/

echo "--- TLS session cache WITHOUT explicit ticket key [CVE-2026-97629]"
grep -rnE 'ssl_session_cache|ssl_session_ticket_key' /etc/nginx/

echo "--- AIO + SSI include virtual [CVE-2026-97205]"
grep -rnE 'aio\s+(on|threads)|include virtual' /etc/nginx/

Use the version from nginx -v to decide whether a hit matters. A 1.31.2–1.31.6 mainline box with variable-based root set is squarely in scope for CVE-2026-93479; the same config on 1.31.1 is not (that version predates the buggy window). And remember the HTTP/3 gate from the 1.31.6 guide: for CVE-2026-95101 the module must be compiled in (nginx -V 2>&1 | grep -- '-with-http_v3_module') and a listen ... quic must actually serve traffic.

The easiest correct read: if you’re on any version ≤ 1.31.6 (mainline) or ≤ 1.30.5 (stable), you’re in scope for at least one of the five - the only open question is which, and the answer only changes your urgency, not the action. Upgrade.

Upgrade: one release closes all five on both branches

Both fixed versions shipped the same day, 14 October 2026, as source and binary packages.[1][8] The routine is identical to any nginx security bump:

# Debian / Ubuntu - current fixed mainline (Oct 2026)
sudo apt update
sudo apt install nginx=1.31.7*
# or take any update the repo offers: sudo apt upgrade

If your distro pins an older stable branch (common on Ubuntu), move to the official nginx.org packages for mainline 1.31.x or stable 1.30.x rather than sitting on an in-scope build.

Validate before you touch the running process:

sudo nginx -t

For a security patch, restart - a reload keeps the old binary serving new connections during the swap. Then confirm the binary actually serving:

sudo systemctl restart nginx
nginx -v
# nginx version: nginx/1.31.7

A note on the features riding along

Both releases add more than fixes, and it’s worth knowing what you get for the same upgrade. The geoip modules (ngx_http_geoip_module, ngx_stream_geoip_module) now read MaxMind DB (MMDB) databases; backend SSL certificates can now be verified by IP address; QUIC supports reconfiguration and binary upgrade when using the quic_bpf directive; and mainline’s HTTP/2 module now uses RFC 9218 prioritization.[1] None of these change the security story - they’re why the release number moved, not why you should update. The five CVEs above are the reason.

What this connects to

This release is the direct successor to 1.31.6’s HTTP/3 fix, which already carries the callout sending you here. The CVE-2026-95101 HTTP/3 injection and CVE-2026-97629 TLS-safe ticket handling both live in the same zone as a properly hardened reverse proxy - if your server block is the one from that guide (plain listen 443 ssl; + http2 on;, no QUIC, explicit keepalive and headers), you’re already outside several of these blast radii, and the upgrade closes the rest.

The short version

nginx 1.31.7 (mainline) and 1.30.6 (stable), released 14 October 2026, fix five medium-severity CVEs: CVE-2026-15176 (buffer overflow in alias + rewrite → $request_filename), CVE-2026-93479 (overflow evaluating string expressions with variables in root/logging, http+stream), CVE-2026-95101 (HTTP/3 unknown-frame-as-body → client_max_body_size bypass / proxied-request injection), CVE-2026-97629 (uninitialized TLS session-ticket key → forged session), and CVE-2026-97205 (use-after-free in AIO + SSI include virtual).[1][2] If you’re on ≤ 1.31.6 / ≤ 1.30.5, you’re in scope for at least one - grep your config for alias/rewrite, variable-based root, quic listeners, ssl_session_cache without an explicit ssl_session_ticket_key, and aio+SSI, then upgrade, nginx -t, restart, and confirm with nginx -v. One restart closes all five.

Sources

  1. nginx - Changes with nginx 1.31.7 / 1.30.6 (14 Oct 2026: five security notes - CVE-2026-15176, CVE-2026-93479, CVE-2026-95101, CVE-2026-97629, CVE-2026-97205; features: geoip MMDB, backend cert verify by IP, QUIC reconfig with quic_bpf, HTTP/2 RFC 9218 prioritization). https://nginx.org/en/CHANGES ; https://nginx.org/en/CHANGES-1.30 - checked 2026-10-17
  2. nginx - Security advisories (all five severity medium; affected ranges: 15176 0.1.29–1.31.6, 93479 1.31.2–1.31.6 & 1.30.0–1.30.5, 95101 1.25.0–1.31.6, 97629 1.23.2–1.31.6, 97205 0.8.11–1.31.6; not vulnerable 1.31.7+/1.30.6+). https://nginx.org/en/security_advisories.html - checked 2026-10-17
  3. CVE-2026-15176 record (F5 CNA; alias+rewrite with $request_filename; conditions partly beyond attacker control; heap buffer overflow → worker restart; code exec only with ASLR disabled/bypassed; data plane only; CWE-122). https://www.cve.org/CVERecord?id=CVE-2026-15176 - checked 2026-10-17
  4. CVE-2026-93479 record (F5 CNA; map directive with regex + root/access-log variable references; heap buffer overflow → DoS, possible code exec with ASLR bypassed; data plane only; CWE-122). https://www.cve.org/CVERecord?id=CVE-2026-93479 - checked 2026-10-17
  5. CVE-2026-95101 record (F5 CNA; ngx_http_v3_module; HTTP/3 with proxy_request_buffering on → data injection in proxied request; CVSS 5.3 MEDIUM 3.1 / 6.9 MEDIUM 4.0; CWE-172). https://www.cve.org/CVERecord?id=CVE-2026-95101 - checked 2026-10-17
  6. CVE-2026-97629 record (F5 CNA; ngx_http_ssl_module; automatic SSL session-ticket key rotation with an uninitialized key → session forgery, possible client-cert verification bypass). https://www.cve.org/CVERecord?id=CVE-2026-97629 - checked 2026-10-17
  7. CVE-2026-97205 record (F5 CNA; ngx_http_core_module; AIO + SSI include virtual → use-after-free, memory corruption or worker crash, possible code exec with ASLR bypassed; CWE-416). https://www.cve.org/CVERecord?id=CVE-2026-97205 - checked 2026-10-17
  8. nginx - download (mainline 1.31.7, stable 1.30.6 source + binary packages). https://nginx.org/en/download.html - checked 2026-10-17