CVE-2026-97205 — nginx 1.30.6 / 1.31.7 security releases (5 CVEs)

Summary

Advisories

nginx.org publishes the vulnerable ranges; F5, which is the CNA, publishes the scores and its own advisory per CVE. F5’s tables list only the versions F5 still supports, so the ranges below are nginx.org’s.

Not vulnerable: 1.31.7+ and 1.30.6+. The fixed releases' changelog and F5’s advisories credit cyberlancer (CVE-2026-97205), Matt Suiche of Tolmo and, at F5, Mateusz Gierblinski (CVE-2026-93479), Hansol Lee of GOTROOT (CVE-2026-95101), and PhiNode Labs (CVE-2026-97629); F5 found CVE-2026-15176 internally.

What each bug needs

• CVE-2026-97205 — aio on or aio threads, and SSI (ssi on) serving a page whose include virtual commands make subrequests. The result is memory corruption or a worker crash, and code execution where ASLR is disabled or bypassed.
• CVE-2026-15176 — a location using alias, where rewrite changed the URI and set or return then reads $request_filename; $request_filename in a log_format reaches it too. A heap overflow in the worker: a crash, and code execution without ASLR.
• CVE-2026-93479 — evaluating string expressions with variables, as in the document root and request logging, in both the http and stream modules. F5’s example is a regex map whose captures are used in root or a log format before the map’s own variable; a non-cacheable variable in a string expression can reach it too. A heap overflow with the same impact as above.
• CVE-2026-97629 — ssl_session_cache shared:… without an ssl_session_ticket_key file, which makes nginx rotate ticket keys itself. One rotated key was left uninitialised, so a client could forge a session — and skip client-certificate verification.
• CVE-2026-95101 — HTTP/3 (listen … quic). Part of an unknown frame could be read as request body, bypassing client_max_body_size and, where the request is proxied, injecting data into the proxied request. proxy_request_buffering on, which F5 names as the condition, is the default.

Naming differences

F5’s advisory titles, which the NCSC-FI alert repeats, name these by module rather than by bug. Two could mislead:

• CVE-2026-97205 is “NGINX ngx_http_core_module vulnerability” at F5; the fix and nginx.org describe it as the AIO and SSI use-after-free.
• CVE-2026-93479 is “NGINX map directive and regex matching vulnerability” at F5 — close to July’s CVE-2026-42533 tracker’s title. nginx.org calls it a buffer overflow in script evaluation; the regex map is one way to reach it, not the only one.

njs and the Kubernetes products

The same F5 announcement covers products this tracker does not follow:

• njs (the ngx_http_js_module / ngx_stream_js_module JavaScript modules): CVE-2026-101025, memory exhaustion when parsing malformed XML, and CVE-2026-101019, inconsistent XML attribute values. Both affect njs 0.7.10 – 1.0.1 and are fixed in njs 1.0.2 (njs advisories). nginx without a js_import directive never runs njs code and is not exposed.
• NGINX Ingress Controller and NGINX Gateway Fabric — F5’s Kubernetes products, which bundle the nginx core and need their own updates from F5. NCSC-FI’s alert lists CVE-2026-94197 and CVE-2026-104939 for the first, and CVE-2026-91184 and CVE-2026-96615 for the second.

Patch status

A row is Fixed once its nginx carries the fix for every one of the five CVEs that applies to its version — a release at or past 1.30.6 (stable) or 1.31.7 (mainline), or a distribution package with the patches backported. Older series are outside some of the ranges: 1.26 is not affected by CVE-2026-93479, and 1.22 only by CVE-2026-97205 and CVE-2026-15176. A package with only some of the fixes stays vulnerable.

Current version is what the release ships today; First fixed is the first build that carried the fixes, and Fixed since the date it became available.

nginx

nginx ships two supported tracks: stable (1.30.x), the one most distributions package, and mainline (1.31.x), where new features land first. Both got their fixed release on the same day, and every older series is past its end of support upstream — a host on 1.28 or earlier gets no further nginx.org release and has to move to 1.30.6 or rely on its distribution’s backports.

For operators building from source, nginx.org publishes no separate patches this time; the fixes ship only in the 1.30.6 and 1.31.7 tarballs.

Debian

The Debian security tracker is the authoritative source for per-suite status. sid, forky, and trixie all carry every fix that applies to their nginx; trixie’s came via DSA-6575-1. bookworm, still on 1.22, lacks the CVE-2026-97205 and CVE-2026-15176 fixes — the only two of the five whose range reaches that series.

Debian packages the stable track only, and the nginx source package also builds the libnginx-mod-* dynamic modules, so one row per suite covers them all.

Debian 11 (bullseye) left Debian LTS on 2026-08-31. Its nginx 1.18 is inside the CVE-2026-97205 and CVE-2026-15176 ranges and no Debian fix is coming — a host still on bullseye needs to upgrade to a supported release, a paid extended-support offering such as Freexian ELTS, or the configuration mitigations below.

pkgsrc

The pkgsrc tree (NetBSD’s package collection, also used on SmartOS, macOS via pkgin, and elsewhere) ships the two tracks as separate packages: www/nginx follows stable and www/nginx-devel follows mainline. pkgsrc-2026Q3, the current quarterly branch, receives fixes by pull-up from pkgsrc-current.

pkgsrc-current’s www/nginx has reached the fixed stable release; www/nginx-devel on the same branch, and both packages on pkgsrc-2026Q3, have not yet picked it up.

The identifier carries an nbN suffix when the package’s PKGREVISION is set. That revision bumps for many reasons besides security patches — recursive bumps for shared-library ABI changes, dependency and build-system tweaks — so an nbN suffix on its own says nothing about these CVEs.

NixOS

nixpkgs builds both tracks: nginxStable (also plain nginx, and the NixOS services.nginx module’s default package) and nginxMainline. Variants such as nginxShibboleth and builds with extra modules from nginxModules derive from one of these two, so the two rows per channel cover them.

nixpkgs-unstable is the channel for Nix users outside NixOS — on macOS or another Linux distribution. A channel row’s Fixed since is the date that channel published its first release containing the fix; a branch row’s is the date the fix was merged into that branch.

The fix landed on master and on release-26.05 the same day, 2026-10-15, and every NixOS channel has since picked it up. Each branch’s lighter -small gate led its sibling: nixos-unstable-small and nixos-26.05-small both published a release carrying the fix that same day. nixos-unstable followed on 2026-10-17, and nixos-26.05 on 2026-10-19.

Flake users

A flake input such as github:NixOS/nixpkgs/nixos-unstable follows the branch of that name, which moves with the channel — so the channel’s row answers for it. An input on master or release-26.05 gets the fix as soon as it lands there, before any channel publishes it.

Detection

First check the version. A build at or past 1.30.6 or 1.31.7 is fixed; a distribution build is fixed only once the table above says so.

nginx -v

The bugs are reachable only through specific configuration, so the next step is to check whether a host uses it. Run the checks against the full configuration that nginx -T prints — it follows every include. Run them as root, or with sudo. A grep only finds candidates: read the surrounding blocks to see whether the directives actually apply to the same requests.

CVE-2026-97205 needs both AIO and SSI. A hit on both of these two is worth a closer look, especially where an SSI page uses include virtual:

nginx -T 2>/dev/null | grep -nE '(^|[[:space:]{;])aio[[:space:]]+(on|threads)'

nginx -T 2>/dev/null | grep -nE '(^|[[:space:]{;])ssi[[:space:]]+on'

CVE-2026-15176 is reachable where alias and $request_filename are used together, with a rewrite changing the URI first — in the same location or at the server level:

nginx -T 2>/dev/null | grep -nE '(^|[[:space:]{;])(alias|rewrite)[[:space:]]|[$]request_filename'

CVE-2026-93479 is reachable through regex map blocks whose captures ($1, $2, …) are used outside the map, among other string expressions — so there is no single grep for it. These lines show where map blocks and regex keys are:

nginx -T 2>/dev/null | grep -nE '(^|[[:space:]{;])map[[:space:]]|^[[:space:]]*"?~'

CVE-2026-95101 needs HTTP/3. Any hit is exposure, since request buffering is on by default:

nginx -T 2>/dev/null | grep -nE '(^|[[:space:]{;])listen[[:space:]].*[[:space:]]quic'

CVE-2026-97629 needs a shared TLS session cache without static ticket keys. A server block that inherits a ssl_session_cache shared: line but no ssl_session_ticket_key line is exposed, unless it sets ssl_session_tickets off; the same directives in the stream module count too:

nginx -T 2>/dev/null | grep -nE '(^|[[:space:]{;])ssl_session_(cache[[:space:]].*shared:|ticket_key[[:space:]]|tickets[[:space:]]+off)'

The njs CVEs need njs code loaded with js_import:

nginx -T 2>/dev/null | grep -nE '(^|[[:space:]{;])js_import[[:space:]]'

Mitigation

The real fix is nginx 1.30.6 / 1.31.7, or a distribution package with the patches. Until one is installed, F5’s advisories list a configuration workaround for each bug; each takes effect on nginx -t && nginx -s reload:

• CVE-2026-97205 — turn off AIO (aio off, the default) or SSI (ssi off). Without AIO, workers may block on disk reads, which matters mostly for large static files under heavy load.
• CVE-2026-15176 — avoid the alias directive, and avoid the $request_filename variable, including in log formats.
• CVE-2026-93479 — use named captures ((?<name>…)) in regex map blocks, and use them only within the block that matched. F5 lists no workaround for the other, non-cacheable-variable path.
• CVE-2026-97629 — load static ticket keys with ssl_session_ticket_key, or set ssl_session_tickets off, or drop the shared: session cache.
• CVE-2026-95101 — set proxy_request_buffering off in proxied locations served over HTTP/3, or stop listening on QUIC.

A workaround does not change a row’s status above: only an nginx build with the fixes does.

Verification log

Every verdict in the table above is backed by a checkable source. This log records the provenance — the advisory, repository index, or git reference that established each fact — so any row can be audited or reproduced. Most readers never need it.

References