So NGINX dropped five CVEs on 14 October, and three of them are 9.2. My first reaction was the same as yours probably: okay, do I need to patch everything tonight?
Short answer: maybe not. Let me explain why.
All five of these bugs only work if your NGINX config uses certain directives. The version number just tells you the buggy code is there. Your config decides if anyone can actually reach it. So before you panic, check your config. That's what I did on my own server, and it took about five minutes.
The five bugs, in plain words
| CVE | What it is | Only a problem if… |
|---|---|---|
| CVE-2026-15176 (9.2) | Heap overflow | Same location has alias + a rewrite that changes the URI, and $request_filename is used somewhere (return, set, if, add_header, log format). |
| CVE-2026-93479 (9.2) | Heap overflow | You have a regex map and its captures are used in root or log_format. Only 1.30.0–1.30.5 and 1.31.2–1.31.6. |
| CVE-2026-97205 (9.2) | Use-after-free | aio is on and you serve SSI pages with include virtual. |
| CVE-2026-95101 (6.9) | Request smuggling | You run HTTP/3 (listen … quic). |
| CVE-2026-97629 | TLS session forgery | Shared session cache without ssl_session_ticket_key. Have ssl_session_tickets off? Then you're fine. |
When the fix came out, none of these were being exploited. Good news, but don't wait for that to change.
The five-minute check
Run this:
sudo grep -RnE "^\s*(alias|rewrite|aio|ssi|map|ssl_session_tickets|ssl_session_ticket_key|ssl_session_cache)\b|request_filename|quic" /etc/nginx/One small trap here. Use capital -R. On Ubuntu, everything in sites-enabled is a symlink, and small -r just skips symlinks. You'll get an empty result and think "great, nothing to worry about", when actually it never looked at your real config.
Now go through what it prints:
- My
aliaswas in the/static/block and my onlyrewritewas in a different block. No$request_filenameanywhere. So 15176 was out. - No
map, noaio, no SSI, noquic. Three more out. ssl_session_tickets offwas already there. Last one out.
Zero out of five. Your result can be different, especially if you use maps or SSI, so do check.
And if you are affected?
Upgrade to 1.30.6 or 1.31.7. If you use the Ubuntu, Debian or RHEL package, wait for their security update instead. They backport the fix into the same version, so nginx -v might still show the old number after patching. That confuses a lot of people. Check the package changelog, not the version string.
Can't patch yet? F5's workarounds are simple enough: don't mix alias with a rewriting location, drop $request_filename, use named captures in regex maps, turn off aio or SSI, set proxy_request_buffering off for HTTP/3, and either remove the shared session cache or set ssl_session_ticket_key.
What I'd tell a friend
Don't patch blind and don't ignore it either. Spend five minutes reading your own config. Most plain reverse-proxy setups won't hit any of these. And keep automatic security updates on, so the fixed package just shows up when your distro ships it.
Personal view only. Always check the vendor advisory for your exact version.
Comments
No comments yet. Share your own debugging war story.