NGINX Patches Five Flaws Including Critical RCE and TLS Bypass in October Update

F5 Networks released NGINX versions 1.30.6 and 1.31.7 on October 14 to address five security vulnerabilities. According to The Hacker News, the update fixes defects ranging from memory corruption issues to protocol handling flaws, with one vulnerability present in every release since May 2005.

The patch set includes three memory bugs that F5 states could crash worker processes or potentially allow remote code execution. F5 assigns these three flaws a CVSS v4.0 score of 9.2, classifying them as critical. NGINX, however, rates all five vulnerabilities as medium severity. None of the issues appeared in the CISA Known Exploited Vulnerabilities catalog as of October 15, and neither vendor has reported active exploitation.

Technical Details and Context

The three memory-related vulnerabilities require specific configuration directives to exploit. According to F5, each flaw involves conditions such as an alias with a rewrite, a regex map, or asynchronous I/O with server-side includes. A heap overflow in a worker process can occur when a location uses an alias, a rewrite changes the URI, and the configuration reads the $request_filename variable.

A fourth vulnerability involves TLS session ticket key rotation. Since version 1.23.2, released in October 2022, NGINX can generate and rotate ticket keys automatically when using a shared session cache. The bug arises because rotation copied only two of three key slots, leaving the third slot with uninitialized memory. This allows forged sessions that may bypass client certificate verification.

F5 describes this forgery as non-deterministic and beyond attacker control. The flaw affects configurations using the ssl_session_cache shared directive, which NGINX documentation recommends. A fifth flaw allows HTTP/3 clients to slip extra bytes into requests sent to backends. This issue requires HTTP/3 support, which is enabled by default in recent versions.

Affected Configurations

Every one of the five vulnerabilities requires a specific directive added by the administrator. The memory bugs affect setups using aliases with rewrites, regex maps, or AIO with SSI. The TLS flaw impacts systems using a shared TLS session cache. The HTTP/3 issue affects any deployment with HTTP/3 enabled.

NGINX’s own documentation recommends the shared session cache and request buffering settings that expose the TLS and HTTP/3 flaws. The previous session-reuse flaw, CVE-2025-23419, was fixed in February 2025. The current update addresses distinct issues. Administrators must review their configurations to determine if they use the specific directives that trigger these vulnerabilities.

What should you do?

Administrators should verify their NGINX versions against the released 1.30.6 and 1.31.7 updates. If immediate patching is not possible, review configurations for the specific directives mentioned in the advisories. Monitor logs for unusual worker process crashes or unexpected backend request formats.

What to do and how to stay safe: NGINX

• Update NGINX to version 1.30.6 or 1.31.7 as soon as possible to mitigate all five vulnerabilities.
• Audit your configuration files for the use of alias directives combined with rewrites that read $request_filename.
• Review TLS settings to check if you are using a shared session cache that may be vulnerable to the key rotation flaw.
• Inspect HTTP/3 configurations to ensure no unexpected byte injection is occurring in backend requests.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Are there any known exploits for these NGINX vulnerabilities?

No, neither NGINX nor F5 has reported attacks, and the flaws were not in the CISA catalog as of October 15.

What is the severity rating for the memory bugs?

F5 rates the three memory bugs as critical with a CVSS score of 9.2, while NGINX rates all five flaws as medium.

Does the TLS flaw affect all NGINX installations?

No, it only affects installations using a shared TLS session cache, a setting recommended in NGINX documentation.