[medium] nginx 1.31.7 / 1.30.6 security fixes (HTTP/3, TLS tickets, overflows)

Thu, 22 Oct 2026 09:20:00 GMT

nginx published multiple medium/major advisories fixed in 1.31.7+ and 1.30.6+, including HTTP/3 request-body injection (CVE-2026-95101), TLS session-ticket forgery (CVE-2026-97629), AIO use-after-free (CVE-2026-97205), and buffer overflows in alias/rewrite and map/regex paths. Same-day chatter bundled this with the PHP/Node/GitLab rush for anyone terminating HTTP on nginx.

Status: closed · Patch: patched · Fixed in: 1.31.7+, 1.30.6+

Latest updates:

2026-10-21: Security advisories and patched releases published on nginx.org.
2026-10-21: nginx 1.31.8 mainline released. (source)
2026-10-14: nginx 1.30.6 stable and 1.31.7 mainline released with fixes for CVE-2026-15176, -93479, -95101, -97629, -97205; njs 1.0.2 fixes CVE-2026-101025. (source)

CVEs: CVE-2026-15176, CVE-2026-93479, CVE-2026-95101, CVE-2026-97629, CVE-2026-97205

[unknown] HTTP/3 QPACK “Header Accordions” memory-amplification DoS

Thu, 22 Oct 2026 09:19:00 GMT

FoxIO published research (Oct 20 2026) showing that missing or late decoded-header limits in QPACK let a tiny HTTP/3 HEADERS frame expand into huge server memory use (up to ~4000× on Bun). Seven of ten implementations tested were vulnerable; quic-go, Cloudflare quiche, lsquic and Wireshark are patched, while Bun, aioquic/mitmproxy and h3 remained unpatched at publication.

Status: live · Patch: partial · Fixed in: quic-go 0.57.0, Cloudflare quiche 0.29.3, lsquic 4.9.0, Wireshark 4.6.2 / 4.4.12

Latest updates:

2026-10-20: FoxIO blog + PoC published; several stacks still unpatched.
2025-11 → 2026-07: Responsible reports to quic-go, quiche, Bun, aioquic, lsquic, h3.

CVEs: CVE-2025-64702, CVE-2026-12523, CVE-2025-13945

pwn.watch: HTTP/3 incident updates

[medium] nginx 1.31.7 / 1.30.6 security fixes (HTTP/3, TLS tickets, overflows)

[unknown] HTTP/3 QPACK “Header Accordions” memory-amplification DoS