NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks

NGINX has shipped versions 1.30.6 and 1.31.7, closing five security holes, one of which has existed in every release since May 2005. Three of the bugs are memory-handling errors — tied to specific setups involving alias+rewrite, regex maps, or AIO with SSI — that can crash a worker process and potentially allow code execution; F5 rates these 9.2 (Critical) under CVSS v4.0. A fourth issue, CVE-2026-97629, affects servers using a shared TLS session cache and can let an attacker forge a session in a way that might slip past client-certificate verification, though F5 describes the forgery as random and not something an attacker can control. The fifth, CVE-2026-95101, lets HTTP/3 clients smuggle extra data into backend requests via a quirk in frame parsing. None of the five flaws appears in CISA's exploited-vulnerability catalog yet, and NGINX itself rates all five as only medium severity, but site operators using the affected directives (alias/rewrite, regex maps, AIO+SSI, HTTP/3, or shared SSL session caches) should apply the update or the listed workarounds. One of the bugs, CVE-2026-93479, stems directly from NGINX's own July fix for the earlier CVE-2026-42533 flaw. NGINX also released njs 1.0.2 the same day to fix two separate medium-severity XML bugs, CVE-2026-101025 and CVE-2026-101019.