NGINX fixes five flaws in 1.30.6 and 1.31.7; configuration determines exposure

Five fixes share a release, not an exposure condition

Cover: AI-generated editorial illustration for P.K. Sharma. Conceptual artwork, not a screenshot or evidence of an observed attack.

NGINX released stable 1.30.6 and mainline 1.31.7 on 14 October 2026. Its security list rates the five listed issues medium. This briefing checks those upstream records on 15 October; it does not label every NGINX installation exploitable. Security list; mainline changes; stable changes.

The release number is the patch destination. The configuration tells an operator which vulnerable mechanism may be reachable. Treat both as evidence: a version-only inventory can miss the exposure condition, while an undocumented assumption that a feature is unused can miss a vulnerable host.

Upstream ranges from the security list. Fixed upstream releases for all five: stable 1.30.6+ or mainline 1.31.7+.

CVE	Listed upstream affected range	Configuration / mechanism
CVE-2026-15176	0.1.29–1.31.6	alias combined with a URI changed by rewrite
CVE-2026-93479	1.30.0–1.30.5; 1.31.2–1.31.6	Variable string evaluation affecting root calculation or request logging
CVE-2026-95101	1.25.0–1.31.6	HTTP/3 unknown-frame data treated as request body
CVE-2026-97629	1.23.2–1.31.6	TLS session ticket key rotation
CVE-2026-97205	0.8.11–1.31.6	AIO with certain SSI include virtual configurations

The feature descriptions come from the release explanation; the advisory list supplies the version ranges. A distributor may apply a backported fix under its own package version. Check that distributor’s notice before treating a lower displayed version as proof it is unpatched.

Feature image: Original typographic editorial cover; no attack or affected customer is depicted. Credit: P.K. Sharma; facts: NGINX.

What the release notes say changes

The notes describe worker-process memory errors in the rewrite/alias and variable-evaluation cases. The HTTP/3 issue can mix unknown-frame content into a request body, potentially bypassing the body-size limit or adding proxied data. The TLS-ticket issue involves an uninitialised rotating key; the AIO case is a use-after-free under the stated SSI conditions. NGINX release notes.

These are distinct security properties. A worker crash, body-content handling and session validation should not be combined into an unsupported claim that the release fixes five remote-code-execution flaws. The reviewed upstream text does not establish an observed exploitation campaign or a victim total.

For a reverse proxy, the configuration review needs to include the boundary with the application behind it. A body-size rule enforced at the edge is useful only if the application’s assumptions about that boundary hold. That is an operational reason to test the proxied workload after the update, not evidence that an application was attacked.

Inspect the effective service, not only a repository file

A useful asset record identifies the package source, binary, service unit or container, loaded modules and effective configuration. Configuration can be assembled through includes and deployment templates. Keep the sensitive output within the operations team: it may reveal internal hostnames, file paths and certificate locations.

Fleet closure also needs to distinguish the new binary on disk from the process serving traffic. Record how the service was replaced, confirm old instances are gone and test the real traffic path. A successful package-manager exit is one piece of evidence, not the whole change record.

Suggested closure evidence, not a claim that these tests were performed here.

Check	Evidence to retain
Package source	Upstream release or distributor security notice
Effective configuration	Reviewed feature inventory for the five conditions
Running service	Version and artefact identity for every active replica
Application behaviour	Post-change HTTP, TLS and proxy smoke-test results

Patch, test and keep the scope exact

Assessment: use the common fixed releases to organise the change, then keep the five exposure checks separate. A later vendor clarification, a distributor backport notice or confirmed incident evidence can change the local priority.