CVE-2026-97629 in NGINX allows forged TLS sessions

NGINX 1.30.6 and 1.31.7 fix CVE-2026-97629: a ticket-key rotation bug left the third key slot uninitialized, letting attackers present a forged TLS session ticket and bypass client-certificate authentication. F5 rates the flaw 8.3 on CVSS v4.0; no exploitation has been reported.

• Affected: versions 1.23.2 through 1.31.6 with shared ssl_session_cache and no ssl_session_ticket_key
• Bug: rotation copied only 2 of 3 ticket-key slots forward
• Forgery is non-deterministic but bypasses client-certificate checks
• Fix: upgrade to 1.30.6 or 1.31.7