mediumclosedpatched
nginx 1.31.7 / 1.30.6 security fixes (HTTP/3, TLS tickets, overflows)
› nginx
Get an email when a new major security incident drops. No spam, unsubscribe any time.
- started
- Oct 14, 2026
- closed
- Oct 14, 2026
- CVEs
- 5
- sources
- 2
## summary
nginx published multiple medium/major advisories fixed in 1.31.7+ and 1.30.6+, including HTTP/3 request-body injection (CVE-2026-95101), TLS session-ticket forgery (CVE-2026-97629), AIO use-after-free (CVE-2026-97205), and buffer overflows in alias/rewrite and map/regex paths. Same-day chatter bundled this with the PHP/Node/GitLab rush for anyone terminating HTTP on nginx.
severity: All five rated medium by nginx
## cve ids[5]
## affected
- Varies per CVE; generally mainline before 1.31.7 and stable before 1.30.6
## fixed in
- 1.31.7+
- 1.30.6+
## timeline[3]
## advisories[2]
## notes & caveats
Fewer high-signal dedicated tweets found in the X search window; seed relies on nginx.org advisories. Marked closed: patches published, no CISA KEV claim in sources consulted.
