NGINX Patches Flaws Enabling Remote Crashes and Potential Code Execution

NGINX released versions 1.31.7 and 1.30.6 to address five vulnerabilities involving alias/rewrite configurations, HTTP and stream processing, HTTP/3 request-body limits, TLS handling, and a use-after-free condition involving SSI with asynchronous I/O. F5 detailed three memory-safety vulnerabilities—CVE-2026-97205, CVE-2026-93479, and CVE-2026-15176—in NGINX Open Source and NGINX Plus that allow unauthenticated remote attackers to crash worker processes through crafted HTTP requests. Code execution may be possible if address space layout randomization (ASLR) is disabled or bypassed. Exploitability depends on the deployed version and configuration; the three flaws affect the data plane, not the control plane. F5 assigned each a CVSS v3.1 score of 8.1 and CVSS v4.0 score of 9.2, with no active exploitation reported in its advisories.

Administrators should inspect active configurations, upgrade affected open-source deployments to the fixed releases, and apply F5-provided updates for NGINX Plus and affected related products. Where immediate patching is not possible, use the configuration workarounds specified in the relevant advisories. The accompanying njs 1.0.2 release fixes two XML-processing vulnerabilities, CVE-2026-101025 and CVE-2026-101019. Corrupted encoding in the release coverage limits confidence in some detailed vulnerability descriptions, making the vendor advisories the appropriate basis for configuration-specific remediation.