NGINX Fixes Five Flaws in 1.30.6 and 1.31.7, but Ubuntu 24.04 Has No Fix Yet: Check Whether Your Config Is Exposed

NGINX released versions 1.30.6 and 1.31.7 on October 14, 2026, fixing five vulnerabilities. F5 scores three of them 9.2 on the CVSS 4.0 scale, and on October 21 the Singapore Cyber Security Agency told users to patch immediately. The nginx.org advisory page rates all five as Medium, and the sources do not agree.

The part that matters for an Ubuntu server is different: on Ubuntu’s tracker, the nginx package for 24.04 shows “Needs evaluation” and no fixed version for CVE-2026-15176. So you cannot just run apt upgrade and be done. What decides your risk is whether your configuration uses the features each bug needs. This post shows the five conditions, a short way to check your own configuration, and the result on my own server.

Quick guide

1. Read your version and your Ubuntu package state.
2. Dump the full configuration with nginx -T so included files are covered.
3. Count the directives that each bug needs, using the grep loop below.
4. If you use one, apply the temporary change from the table, then update when your distribution ships a fix.

The five flaws and what each one needs

CVE	Bug	What your config needs for it	Versions affected (nginx.org)
CVE-2026-15176	Heap buffer overflow, CVSS 4.0 score 9.2	A location using alias with rewrite and a set or return that uses $request_filename, or that variable in an access log format	0.1.29 to 1.31.6
CVE-2026-93479	Heap overflow in script evaluation, listed by two sources as the map directive with unnamed regex captures	A map block with unnamed captures	1.31.2 to 1.31.6 and 1.30.0 to 1.30.5
CVE-2026-97205	Use after free, CVSS 4.0 score 9.2	Asynchronous file I/O (aio) together with Server Side Includes (include virtual)	0.8.11 to 1.31.6
CVE-2026-95101	Request body injection in HTTP/3, CVSS 4.0 score 6.9	HTTP/3 in use	1.25.0 to 1.31.6
CVE-2026-97629	Session forgery with TLS session tickets, CVSS 4.0 score 8.3	A shared TLS session cache with ticket keys not loaded manually	1.23.2 to 1.31.6

The version ranges are from the nginx.org security advisories page, which lists all five as Medium. The conditions are from the DEV Community write-up and the Singapore CSA alert, and the scores are the F5 figures they quote. For CVE-2026-15176 the Ubuntu tracker gives the same condition and adds that an attacker can crash the worker process, and may get code execution where ASLR is off or can be bypassed. Where two of these sources describe a bug differently I say so in the table. I could not open the F5 advisories, so I did not read them.

Step 1: what is my server running

Type these three commands. The first two show the version and the Ubuntu package. The third counts how many of the five CVE numbers appear in the package changelog:

nginx -v

apt-cache policy nginx | head -3

apt changelog nginx 2>/dev/null | grep -c -E "CVE-2026-(15176|93479|95101|97629|97205)"

My server runs nginx 1.24.0 with the Ubuntu package 1.24.0-2ubuntu7.18, installed and candidate are the same, and none of the five CVE numbers appears in the changelog. Do not read anything into the 1.24 version number itself, because Ubuntu backports fixes into its own builds. The tracker is the place to look:

Step 2: check your configuration

nginx -T prints the whole effective configuration including every included file. Save it once, then count the directives the conditions mention:

sudo nginx -T > nginx-full.conf 2>/dev/null
for d in alias rewrite map aio ssi http3 ssl_session_cache
do
  printf "%-18s %s\n" $d "$(grep -cE "^\s*$d\b" nginx-full.conf)"
done
grep -c request_filename nginx-full.conf
grep -cE "^\s*ssl_protocols" nginx-full.conf

Every count is zero. The last line is a control: ssl_protocols appears three times, so the pattern does match real lines. On this server none of the configuration conditions in the table are met as I read them. CVE-2026-93479 and CVE-2026-95101 also affect only newer versions than 1.24.0 according to nginx.org. That is a reason not to panic, not a clean bill of health. The grep matches directive names at the start of a line, and a non-zero count means you read the surrounding block, it does not prove exposure.

If you are exposed

• CVE-2026-15176: avoid alias inside location blocks and avoid $request_filename (Singapore CSA).
• CVE-2026-97205: disable asynchronous file I/O or Server Side Includes (Singapore CSA).
• CVE-2026-93479: use named captures instead of unnamed ones, and keep them inside the block that matched (Singapore CSA).
• CVE-2026-97629: configure and rotate ticket keys yourself, and rotate them after upgrading (DEV Community write-up).
• Updating: the fixed upstream versions are 1.30.6 and 1.31.7. On Ubuntu, wait for a package from Canonical or move to the nginx.org packages. I did not do either on my server.

This is the same kind of decision as in my SCTP post: a critical score on paper, and a check of whether your own system can reach the bug.

Caveats

Severity depends on the source: F5 and the Singapore CSA use the CVSS 4.0 scores of 9.2, nginx.org lists Medium, and Ubuntu lists CVE-2026-15176 as Medium priority with a CVSS 3.1 score of 8.1. Coverage in search results said none of the five was in the CISA catalog and no attacks were reported, but I could not open that article and I did not check the catalog myself. I checked Ubuntu’s status for CVE-2026-15176 only. The configuration result is for my own server, which has a simple configuration.

FAQ

Which NGINX versions fix these flaws?

Versions 1.30.6 and 1.31.7, released October 14, 2026, according to the nginx.org advisories page.

Is there an Ubuntu 24.04 fix?

On the day I checked, Ubuntu’s tracker listed the nginx package for 24.04 as Needs evaluation for CVE-2026-15176, with no fixed version. I did not check the other four.

How do I know if my configuration is exposed?

Save the output of sudo nginx -T and look for alias with rewrite and request_filename, map with unnamed captures, aio with SSI, HTTP/3, and a shared ssl_session_cache without manual ticket keys.

Are these flaws being exploited?

The coverage I could read said no attacks were reported. I could not verify that against CISA or F5 directly.

Should I switch to the nginx.org packages?

Only if you need the fix before Ubuntu ships one. It changes where your updates come from, so test it first. I did not switch.

Sources

• nginx security advisories, nginx.org
• CVE-2026-15176, Ubuntu Security
• Critical vulnerabilities in F5 NGINX products, Cyber Security Agency of Singapore
• NGINX’s October fixes, DEV Community