nginx 1.30.6 and 1.31.7: the October 2026 security release

Five nginx CVEs fixed in October 2026: the affected directives, exposure conditions, fixed versions, and how to confirm which build is actually serving.

By the Maborak engineering team · 2026-10-29 · 3 min read

nginx 1.31.7 and 1.30.6, released in October 2026, fix five security issues. nginx.org lists all five as medium severity. The affected ranges differ by release branch, so the useful question is not whether “nginx” is vulnerable, but which build is serving and whether its configuration reaches the affected code.

Checked 29 October 2026. The affected ranges, severities and fixed versions below are quoted from the nginx advisory page. We have not independently reproduced any of these issues.

The five advisories

Fixed versions are those listed as “not vulnerable” on the nginx advisory page. Older stable branches such as 1.28 did not receive these releases; distributions may backport the fixes into their own package versions, so match the installed package to the vendor’s advisory rather than to the upstream version string alone. The primary references are the nginx security advisories and the F5 advisories linked from each entry.

Severity is not a configuration

nginx.org rates all five as medium. Some third-party coverage described three of them as critical. Neither number tells you whether your configuration is exposed. A scanner that reads only the version string will flag the build without knowing whether it uses alias with rewrite, HTTP/3, TLS session tickets or AIO. Treat the vendor advisory as the source for affected ranges, and establish exposure from the configuration that is actually loaded.

What to check in the running configuration

The advisories name the features involved. Review the loaded configuration for each one:

• alias combined with rewrite (CVE-2026-15176).
• Script evaluation (CVE-2026-93479); review any module or directive that evaluates scripts in the request path.
• HTTP/3, for example a listen ... quic socket (CVE-2026-95101).
• TLS session tickets (ssl_session_tickets) and any explicit ticket key (CVE-2026-97629).
• Asynchronous file I/O, aio on or aio threads (CVE-2026-97205).

A useful first pass, run with the privileges needed to read the configuration:

nginx -v
nginx -V 2>&1 | tr ' ' '\n' | grep -iE 'v3|quic'
nginx -T 2>/dev/null | grep -nE 'aio |ssl_session_tickets|alias |rewrite |listen .*quic'

nginx -T dumps the effective configuration. Treat its output as sensitive: it can include paths, upstreams and credentials passed through the configuration.

Confirm the build that is actually serving

nginx -v in a shell may report a different binary or container from the one behind the proxy. Check the package version and, for containers, the image digest and the worker process start time. A docker pull does not change a pinned digest, and an updated tag in a manifest does not prove that every replica runs it.

For a rolling replacement:

nginx -t
systemctl reload nginx    # or: nginx -s reload

A reload starts new worker processes; confirm the old workers exit and that requests reach the new generation. In containers, rebuild the image and recreate the service rather than reloading shared state in place.

Fixed releases

Upgrade to 1.31.7 or 1.30.6, or to the distribution’s backported package. If the deployment skipped earlier 2026 releases, moving to these versions also carries the previously fixed issues, including the map-with-regex overflow (CVE-2026-42533) fixed in 1.31.3 and 1.30.4.

The verification procedure above establishes which build is serving. It does not prove that no issue was reachable before the upgrade; if you need that assurance, review logs and configuration for the affected features over the exposure window.

Topics: security, infrastructure