NGINX patches five security holes in paired releases, two of them reaching back to 2009
NGINX spent its recent patch cycle reaching into its own history. Today, paired updates to both active branches has been released, fixing five vulnerabilities. Two of those flaws reach all the way back to 2009.
The drop lands as nginx-1.31.7 (mainline) and nginx-1.30.6 (stable). Both carry the same five security fixes, all rated "medium" by F5, NGINX's parent company. The mainline version adds features. The stable branch adds none of them, by design.
If you run any NGINX version from 0.1.29 onward, treat this as urgent. That range spans nearly two decades of builds. A lot of what's deployed out there sits inside it.
Keep in mind that NGINX isn't a niche server. Per W3Techs it powers about 33.8% of all websites as of April 2025, edging out Apache and Cloudflare Server. It fronts API traffic, media streams, and enough e-commerce to matter. A flaw that bites broadly is worth a second look.
Five issues, one door left wide open
The five CVEs are patched in both branches. Here's what they are and, more importantly, how far back they reach.
CVE-2026-15176 is the one that should make you pause. It's a buffer overflow triggered when the alias directive combines with rewrite and the request URI gets remapped to a file path. Vulnerable versions run from 0.1.29 through 1.31.6. That range starts in 2009. Everything in between gets hit, including most deployments people still run today.
CVE-2026-97205 is similar in reach. It's a use-after-free in asynchronous file I/O when an SSI page uses include virtual. It goes back to 0.8.11, so again 2009. Two of the five flaws reach back to the same year NGINX was still winning the C10k war against Apache.
The other three are narrower. CVE-2026-93479 is a buffer overflow in string-expression evaluation with variables, hitting document-root calculation and request logging. It only affects 1.31.2 through 1.31.6 and 1.30.0 through 1.30.5, a fairly recent window. CVE-2026-95101 is more interesting if you're on HTTP/3. A fragment of an unknown QUIC frame can be misread as the request body, letting you bypass client_max_body_size for a denial-of-service, or inject data into a proxied request. It spans 1.25.0 onward. CVE-2026-97629 is a session-forgery risk: a TLS session-ticket rotation key is left uninitialized, which lets an attacker forge sessions. That runs from 1.23.2 to 1.31.6.
For context, F5 rated all five as medium. The wide reach on the first two is what pushes this from "schedule it" to "do it this afternoon."
It's worth pausing on the HTTP/3 flaw. NGINX's newest protocol stack isn't something most places run yet, but the ones that do care about latency. A limit bypass plus a potential injection vector in the same hole is the kind of thing you want fixed before someone tries it.
That said, the medium rating holds up under inspection. None of these are remote-code-execution bombs flagged as critical. What makes them urgent is exposure, not potency. A memory-corruption hole in a worker process is exactly what turns into something worse once someone gets lucky.
What's new and what to do
The mainline branch is where the actual new stuff lives. nginx-1.31.7 adds MaxMind MMDB GeoIP support, modernizing geolocation lookups so you can point at current .mmdb files instead of legacy formats. It also gains QUIC hot-reload and binary-upgrade capability via the quic_bpf directive, so rolling restarts won't drop connections for QUIC deployments. Backend SSL certificate verification now accepts IP-address subjectAltNames, and the stream module picks up GeoIP2.
The stable branch carries none of that. That's the discipline of the two-branch model: stable gets proven security patches without the feature churn. 1.30.6 does lower some SSL error-log levels from crit to info and flips behavior on SSL connections closed without close_notify, but functionally it's a fixes-only drop.
Deciding which branch to take comes down to how you operate. If you want the new features, go mainline. If you'd rather run a locked-down, proven build, stay stable. Either way, grab the version, since both fix the same five holes.
Check your branch with nginx -v. If your config uses alias with rewrite, AIO with SSI, HTTP/3, or TLS session-ticket rotation, the fixes apply directly. Given how far the CVE ranges stretch, upgrading regardless of config is the smart move.
One thing to skip: don't stick around on 1.29.x or 1.28.x. Those branches are end-of-life and get no patches. Migrate to 1.30.x or 1.31.x if you've been sitting there.
The release was put together by pluknet, a core NGINX community maintainer, with fixes credited to external researchers including Matt Suiche of Tolmo Inc., Hansol Lee of GOTROOT, PhiNode Labs, and cyberlancer. It's a good reminder that the project still runs on community contributors, even after F5 bought the company for $670 million in 2019 and founder Igor Sysoev walked away in 2022. The frustration that split has spawned forks like Angie and freenginx, but the main line still pulls in external fixes like this one.
It's a solid, if unspectacular, security drop. Five medium-severity patches, two of them covering holes open for nearly two decades. Nothing flashy. But NGINX runs a third of the internet, and a third of that internet was running unpatched software all along. That's enough reason to fix it.
Head here for the full changelogs for mainline and here for stable.
