Nginx 1.31.7 and 1.30.6 patch five long-standing security bugs
Two of the five bugs have existed since nginx's earliest releases. All are rated Medium severity, and most need no authentication to trigger.
The nginx project released 1.31.7 (mainline) and 1.30.6 (stable) on 14 October, closing five vulnerabilities listed on its own security advisories page.
Two go back a long way: CVE-2026-15176, a buffer overflow when the alias directive is combined with rewrite, has been present since version 0.1.29, and CVE-2026-97205, a use-after-free in asynchronous file I/O, since 0.8.11. The other three affect regex capture handling in map directives (CVE-2026-93479), request body handling over HTTP/3 (CVE-2026-95101), and TLS session ticket key rotation (CVE-2026-97629). nginx rates all five Medium severity, and a remote attacker needs no credentials to trigger most of them with a crafted request.
Why it matters: nginx sits in front of a huge share of the web, so a single request that crashes worker processes is a real denial-of-service risk, not a theoretical one. Two of these bugs have shipped since nginx’s earliest releases without being caught. Upgrading to 1.31.7 or 1.30.6 fixes all five at once.
The caveat: nginx calls these Medium, not Critical, and three of the five only trigger with specific directive combinations, so not every install is equally exposed. Check your config for alias paired with rewrite, unnamed regex captures in map, and AIO alongside SSI before assuming you are in the clear.