NGINX patches five CVEs in 1.31.7 and 1.30.6

NGINX released 1.31.7 and 1.30.6 on 14 October 2026, fixing five security flaws, three of them rated 9.2 under CVSS v4.0. They include a heap overflow tied to alias with $request_filename, a use-after-free with SSI and AIO, HTTP/3 byte injection and TLS session ticket forgery.

• CVE-2026-15176: heap overflow with alias and $request_filename, affects 0.1.29 and later
• CVE-2026-97205: use-after-free with SSI and AIO, rated 9.2
• CVE-2026-97629: TLS session forgery via automatic ticket key rotation, rated 8.3
• CVE-2026-95101: extra bytes sent to backends over HTTP/3, rated 6.9