nginx fixes five vulnerabilities in versions 1.31.7 and 1.30.6
nginx released security advisories fixing five CVEs in the mainline and stable branches. According to HKCERT, a remote attacker could exploit some flaws to run code, cause denial of service, bypass security restrictions and disclose sensitive information. The sources report no active exploitation; upgrade to 1.31.7 (mainline) or 1.30.6 (stable).
What happened
nginx published official advisories with fixes for five vulnerabilities. Fixes shipped in versions 1.31.7 (mainline) and 1.30.6 (stable). HKCERT rated the set as medium risk.
Why it matters
HKCERT states a remote attacker could exploit some flaws to run code, take services down, bypass security controls and expose data. Outdated nginx servers are exposed to these effects.
What to do
Upgrade now to nginx 1.31.7 or later (mainline) or 1.30.6 or later (stable). Inventory the versions currently deployed.
For the technical team
- CVE
- CVE-2026-15176, CVE-2026-93479, CVE-2026-95101, CVE-2026-97629, CVE-2026-97205
- Affected
- nginx · nginx mainline before 1.31.7; nginx stable before 1.30.6. Exact scope varies per CVE, per the official advisory.
- Exploitation
- No exploitation reported in the sources; no PoC cited.
- Fix
- Upgrade to nginx 1.31.7 or later (mainline) or 1.30.6 or later (stable). Vendor fixes listed at nginx.org/2026.html, cited by HKCERT.
- Vector
- Varies per CVE; the sources do not detail the component or exploitation precondition. HKCERT describes a remote attacker able to exploit some of the flaws.
- More details
- nginx advisories dated 2026-10-14. HKCERT bulletin published 21 Oct 2026 rates risk as medium and lists possible impacts: remote code execution, denial of service, security restriction bypass and sensitive information disclosure. CVEs: CVE-2026-15176, CVE-2026-93479, CVE-2026-95101, CVE-2026-97205, CVE-2026-97629.
Timeline
Official nginx advisories list fixes for the mainline and stable lines.
