NGINX fixes three serious flaws that could lead to DoS or remote code execution under certain conditions

NGINX vulnerability fixes include the nginx-1.30.6 and nginx-1.31.7 releases, published on October 14, 2026. The updates address five security flaws in total, including CVE-2026-15176, CVE-2026-93479, and CVE-2026-97205. According to an NHS England alert, these three flaws could, under specific configuration conditions, allow an unauthenticated attacker to cause a denial of service or, under additional conditions, achieve remote code execution.

The risk does not automatically affect every NGINX server. In affected configurations, the most likely consequence is a worker process crash or restart. The possibility of remote code execution depends on ASLR being disabled or on the attacker being able to bypass that mechanism. This is therefore not confirmed universal remote code execution across all deployments.

NGINX vulnerability fixes are available in the 1.30 and 1.31 branches

NGINX security advisories list fixed versions 1.30.6 and 1.31.7 for CVE-2026-15176, CVE-2026-93479, and CVE-2026-97205. Administrators should first verify the version in use and then update to the applicable fixed release.

Particular attention should be paid to publicly accessible servers and reverse proxies using the relevant configuration combinations. NGINX is used as a web server and reverse proxy, so a worker process outage may affect service availability.

• CVE-2026-15176 and CVE-2026-97205 also have configuration mitigations, according to available information.
• When reviewing the configuration, pay attention to alias and rewrite settings, regex maps, and the combination of AIO with SSI.
• Updating to nginx-1.30.6 or nginx-1.31.7 is an available way to remove the listed flaws.

Different assessments use different scales

NHS England gives the three listed CVEs a CVSSv4 score of 9.2 and a critical classification. NGINX labels them medium on its own scale. These labels should be read in the context of different assessment methodologies, not as an indication that the vulnerabilities’ technical status has changed.

NGINX’s primary advisories describe the issues in connection with alias/rewrite and AIO/SSI configurations. Administrators should rely on these technical conditions when assessing impact.

Active exploitation has not yet been confirmed

Independent news coverage from October 19 states that F5 has not yet labeled these vulnerabilities as exploited in the wild. Available information does not confirm active exploitation of the specific CVEs.

Further developments may confirm or disprove exploitation by F5, CISA, or other authorities, or provide new technical details and evidence of a working exploit. Any updated fixes or advisories for commercial F5 products built on NGINX will also be relevant.

Verified and updated: October 20, 2026 06:23