nginx Patches Five Vulnerabilities at Once, Including a Bug Present Since 2005
On October 14, 2026, nginx released version 1.31.7, fixing five security vulnerabilities in one go. The stable counterpart, 1.30.6, followed the next day. Three of the five are memory-corruption bugs; nginx rated all of them medium severity — but the US National Vulnerability Database assigned three of them a high-severity score of 8.1.
What stands out most is the age. The oldest bug, CVE-2026-15176, affects configurations since version 0.1.29, released on May 12, 2005. That day's changelog noted one new feature: the SSI module gained support for the include virtual command. That feature lived for twenty-one years before someone found that combining it with another feature could crash the process.
Three Memory Bugs, Three Combinations
nginx configurations are built from directives, and the problems here come not from any single directive but from combinations.
The first bug involves alias combined with rewrite. alias maps URL paths to a different location on disk; rewrite rewrites the request URI. Used separately, both are fine. Stacked together — with the rewritten URI mapped to a file path — a heap buffer overflow lurks in the worker process. A correctly written configuration lets the bug sleep for twenty-one years; a cleverly crafted request can trigger a crash. The official wording is restrained: remote code execution is possible, provided the system's ASLR (address space layout randomization) is disabled or bypassed by the attacker.
The second bug combines asynchronous file I/O with SSI. Async file I/O was added in August 2009; SSI's include virtual came in 2005. Two long-lived features together produce a use-after-free: freed memory is referenced again, memory gets corrupted, and the process crashes. Same ASLR precondition, same "theoretically executable code."
The third bug is the youngest, introduced only in June. When the map directive is combined with regex matching, and a regex capture variable is referenced before the map's output variable, evaluating the string overflows — affecting document root computation and request logging. It impacts both the http and stream modules and existed for four months (versions 1.31.2–1.31.6 and 1.30.0–1.30.5).
Common threads across the three: all are memory errors, all sit in the worker process, and RCE is blocked by the ASLR hurdle. Modern systems enable ASLR by default, so nginx rated all three medium — the crash is certain, code execution is theoretical. NVD didn't care and scored them 8.1 anyway. Both perspectives have merit: for operators, these five bugs warrant an upgrade today; for exploit developers, one hurdle remains.
Two Protocol-Layer Bugs
The remaining two don't touch memory; they touch protocols.
The HTTP/3 bug affects every version since 1.25.0 (May 2023, when HTTP/3 first shipped in a stable nginx release). QUIC defines "unknown frames": protocol features from newer versions that older servers don't recognize. The flaw lies in how nginx reads frames — part of an unknown frame can be misread as the request body. Two consequences: bypassing the client_max_body_size limit, or injecting data into proxied backend requests. The former can fill your disk; the latter is dirtier — nginx usually stands between the internet and your application, shielding it from users. This bug lets user input leak through.
The TLS bug is subtler. TLS session resumption relies on ticket keys, and nginx has supported automatic key rotation since 1.23.2. In the rotation implementation, one key was left uninitialized. An attacker can forge TLS sessions — with two official caveats: in a non-deterministic way, and not under the attacker's control. Uncontrollable forged sessions sound less threatening, but forgery itself breaks one class of defense: client certificate verification. If your server requires a client certificate before granting access, a forged session can bypass that step. nginx rates it medium; NVD scores 6.5. The trigger: a shared ssl_session_cache with no explicit ticket key file configured — precisely the most common default setup.
Who Found Them
The official changelog credits four bugs to: Matt Suiche (Tolmo Inc.), Hansol Lee (GOTROOT), PhiNode Labs, and cyberlancer. The first name deserves a pause — Matt Suiche is a veteran of memory forensics, founder of Comae, specializing in crash dump analysis. Using memory forensics to find nginx memory bugs is fitting. The oldest alias bug has no attribution in the changelog.
The fix is simply upgrading: 1.31.7+ (mainline) or 1.30.6+ (stable), with 1.31.8 following on October 24. The checklist is short: audit alias with rewrite; check AIO + SSI setups; check map with regex capture variables; upgrade if you run HTTP/3; upgrade if you use automatic TLS ticket key rotation. The five bugs share no common trigger — only the fact that they all lived in nginx, software serving roughly a third of the web, famously stable. So stable that nobody imagined the first bug had been waiting twenty-one years.
Ten days later, 1.31.8 shipped. The changelog returned to calm: the Security section vanished, and the feature list went back to new functionality and endless minor fixes.
---
*Sources: nginx.org official security advisories and CHANGES (1.31.7, 2026-10-14); NVD CVE entries (CVE-2026-15176 / 93479 / 97205 / 95101 / 97629, published 2026-10-14); F5 security advisories K000162416/K000162606-K000162613; release dates from nginx CHANGES files (0.1.29: 2005-05-12; 0.8.11: 2009-08-28; 1.23.2: 2022-10-19; 1.25.0: 2023-05-23; 1.31.2: 2026-06-17).*