nginx Security Vulnerabilities in 2026: October Fixes, NGINX Rift, and a Zero-Downtime Upgrade Guide

nginx has had an unusually busy 2026. More than 25 security advisories have been published this year. The latest release, nginx 1.30.6 (stable) and 1.31.7 (mainline) on October 14, 2026, fixes five more. F5, which maintains nginx, rated three of them CVSS v4.0 9.2 and issued out-of-band patches across NGINX Plus, NGINX Ingress Controller, and NGINX Gateway Fabric. Separately, NGINX Rift (CVE-2026-42945), a rewrite-module buffer overflow disclosed in May, has been actively exploited. If any of your servers run nginx older than 1.30.1, treat them as urgent.

This article was created with AI assistance. Version ranges were checked against the official nginx security advisories page on October 23, 2026. Confirm details in the nginx and F5 advisories before acting.

TL;DR: which nginx version to install

nginx October 2026 security fixes

All five are fixed in 1.30.6 and 1.31.7. The nginx project labels them Medium because exploitation depends on configuration. F5 rates the first three critical because, in a matching configuration, crafted requests can corrupt worker memory, crash workers, and potentially lead to remote code execution, especially where ASLR is disabled or bypassed. F5 reported no evidence of active exploitation when the patches were released.

The same day, njs 1.0.2 fixed two issues in its XML handling (CVE-2026-101025 and CVE-2026-101019). Update njs if you use the JavaScript module for XML parsing or signed XML validation.

NGINX Rift and the other high-impact nginx CVEs of 2026

Patching to 1.30.6 or 1.31.7 also closes every earlier 2026 advisory. These are the ones that matter most if you are behind:

FINRA, the US broker-dealer regulator, issued an alert on NGINX Rift after a growing number of member firms were found to be potentially affected. Do not stop at your web servers: appliances, load balancers, and vendor products often embed nginx, so ask vendors for their fixed versions.

Check your nginx version and exposure

# Version and build options (modules such as http_v3, file-aio, dav, mp4, slice)
nginx -v
nginx -V 2>&1 | tr ' ' '\n' | grep -E '^--with-|^--add'

# Full effective configuration, filtered for the risky directives
sudo nginx -T 2>/dev/null | grep -nE '^\s*(alias|rewrite|aio|ssi|map|ssl_session_ticket|listen .*quic|http3)\b'

# Unnamed regex captures inside map blocks ($1, $2 ...)
sudo nginx -T 2>/dev/null | grep -nE '\$[0-9]'

# Is ASLR enabled? (2 = full randomization)
cat /proc/sys/kernel/randomize_va_space

# Is a running master still using a replaced binary?
sudo ls -l /proc/$(cat /run/nginx.pid)/exe

If ls -l /proc/<pid>/exe shows (deleted), the package was upgraded but the running nginx is still the old, vulnerable binary.

Interim mitigations from the advisories

Upgrading is the fix. If you need a few hours, F5’s guidance and the advisories point to these configuration changes:

• CVE-2026-15176: avoid combining alias with rewrite, and avoid using $request_filename with alias. Use root where possible.
• CVE-2026-93479 and CVE-2026-42533: switch regex captures in map blocks and string expressions to named captures, for example ~^/(?<tenant>[^/]+)/ with $tenant.
• CVE-2026-97205: disable aio, or stop serving SSI (ssi off;) where AIO is required.
• CVE-2026-95101: temporarily remove HTTP/3 (quic) listeners; clients fall back to HTTP/2.
• CVE-2026-97629: set ssl_session_tickets off; until patched. Sessions still resume through the session cache.
• Everywhere: keep ASLR enabled, run workers as an unprivileged user, and segment nginx from internal networks so a compromised worker cannot reach everything.

Always run nginx -t before applying configuration changes, and remove workarounds after upgrading so you do not carry unnecessary differences.

nginx upgrade paths by setup

Official nginx.org packages

If you use the nginx.org repositories, choose the stable or mainline repository and upgrade:

# Debian/Ubuntu with the nginx.org repo
sudo apt-get update && sudo apt-get install --only-upgrade nginx

# RHEL/Alma/Rocky with the nginx.org repo
sudo dnf upgrade --refresh nginx

Packages from nginx.org follow upstream version numbers, so nginx -v should report 1.30.6 or 1.31.7 and later.

Distribution packages

Debian, Ubuntu, RHEL, and Alpine keep their own nginx versions and backport security fixes. A distribution package may report an older upstream version and still be patched. Check the vendor advisory (DSA, USN, RHSA, or Alpine secdb) for the fixed package release, not the upstream number.

Docker images

Official nginx images publish tags such as nginx:1.30.6, nginx:stable-alpine, and nginx:mainline. Rebuild with docker build --pull, update pinned tags or digests, and redeploy. If you compile third-party dynamic modules into your image, rebuild them against the new nginx version; dynamic modules must match the nginx version they load into.

Kubernetes ingress

• F5 NGINX Ingress Controller and NGINX Gateway Fabric: upgrade to the releases named in F5’s advisories, usually through a Helm chart version bump and a rolling update of the controller pods.
• Community ingress-nginx: the Kubernetes project announced the retirement of ingress-nginx in March 2026. If you still run it, plan a migration to a maintained controller or the Gateway API, and in the meantime minimize custom snippets and exposure.
• Roll controllers one replica at a time, with enough replicas and a PodDisruptionBudget to keep traffic flowing.

NGINX Plus

Install the fixed NGINX Plus release listed in F5’s advisory for each CVE through your NGINX Plus repository, then perform the same zero-downtime binary upgrade.

Source builds, OpenResty, and forks

For source builds, record nginx -V options, build the new release with the same flags into a new prefix, and switch. OpenResty, Tengine, Angie, and other distributions built on nginx publish their own releases; check whether their base includes these fixes before assuming you are covered.

Zero-downtime nginx binary upgrade

A configuration reload (nginx -s reload or systemctl reload nginx) does not load a new binary. To switch to the patched binary without dropping connections, use nginx’s built-in upgrade-on-the-fly:

sudo nginx -t                                   # validate config with the new binary
sudo kill -USR2 $(cat /run/nginx.pid)           # start a new master with the new binary
#   old master's PID moves to /run/nginx.pid.oldbin
sudo kill -WINCH $(cat /run/nginx.pid.oldbin)   # gracefully stop old workers
#   verify traffic and logs on the new workers, then:
sudo kill -QUIT $(cat /run/nginx.pid.oldbin)    # retire the old master

# Rollback before QUIT: restart old workers and stop the new master
# sudo kill -HUP $(cat /run/nginx.pid.oldbin) && sudo kill -QUIT $(cat /run/nginx.pid)

Behind a load balancer, the simpler alternative is to drain one node, run systemctl restart nginx, verify it, and return it to rotation.

Verify the nginx upgrade

1. Run nginx -v on every host and image, and check /proc/<pid>/exe no longer shows (deleted).
2. Watch the error log for worker crashes (signal 11, exited on signal). Repeated crashes before the upgrade may indicate exploitation attempts.
3. Run smoke tests through every server block, including HTTP/3 and TLS resumption if you use them.
4. Re-run vulnerability scans so your inventory reflects the new version.

Harden nginx after you patch

• Hide the version: server_tokens off; so the Server header does not advertise exactly which CVEs apply to you.
• Remove unused modules and features: HTTP/3, SSI, DAV, mp4, and slice each appear in this year’s advisories. Disable the ones you do not need.
• Rate-limit sensitive routes with limit_req, especially login, password reset, and other expensive endpoints.
• Keep CORS and security headers deliberate: avoid reflecting arbitrary origins with credentials in add_header rules.
• Track upstream advisories: subscribe to the nginx-announce mailing list and F5 security notifications.

How DAST tools help you catch these issues sooner

nginx sits in front of your APIs, so its configuration is part of your attack surface. No scanner can predict the next nginx CVE, and patching is the only fix for these. A DAST tool does test what attackers see from outside, which is exactly where nginx misconfiguration shows up.

DastPilot scans your APIs through the same nginx front door your users hit, using your OpenAPI spec or Postman collection and every role you configure. Checks most relevant to nginx:

• Version fingerprinting: flags Server and X-Powered-By headers that reveal versions, such as Server: nginx/1.30.0, which tells an attacker you are vulnerable to NGINX Rift.
• CORS misconfiguration: detects origins reflected with credentials, a common mistake in nginx add_header rules.
• Rate-limit gaps: tests authentication endpoints for missing brute-force protection that limit_req should provide.
• Exposed schemas, debug surfaces, and verbose errors: finds public API documents, unauthenticated internal endpoints, and stack traces leaking through the proxy.
• Path traversal and injection on API parameters, plus BOLA and BFLA authorization checks behind the proxy.
• Regression tracking: each scan is compared with the last, so a header or CORS rule lost in an emergency config change is flagged as reopened.

Rescan after applying temporary mitigations and again after the upgrade, to confirm your APIs still behave correctly through the patched proxy. If your upstream services run on Node.js or PHP, see our guides to the Node.js October 2026 security release and the critical PHP security release.

Frequently asked questions

Which nginx version fixes the October 2026 vulnerabilities?

nginx 1.30.6 (stable) and 1.31.7 (mainline), released on October 14, 2026, fix CVE-2026-15176, CVE-2026-93479, CVE-2026-95101, CVE-2026-97629, and CVE-2026-97205. Mainline 1.31.8 followed on October 21, 2026. NGINX Plus and F5 products have their own fixed releases.

What is NGINX Rift?

NGINX Rift is the name given to CVE-2026-42945, a buffer overflow in the ngx_http_rewrite_module disclosed in May 2026. It affects nginx 0.6.27 through 1.30.0, has been actively exploited, and is fixed in nginx 1.30.1 and 1.31.0 and later.

Are the October 2026 nginx vulnerabilities critical?

F5 rated CVE-2026-15176, CVE-2026-93479, and CVE-2026-97205 at CVSS v4.0 9.2, while the nginx project labels them Medium because exploitation depends on specific configurations such as alias with rewrite, unnamed regex captures in map blocks, or AIO with SSI. Patch regardless of rating.

Does nginx reload apply a security update?

No. A configuration reload keeps the running binary. Use nginx’s binary upgrade procedure (USR2, WINCH, then QUIT signals) or restart nginx behind a load balancer, then confirm the running process uses the new binary.

How do I check if my nginx is vulnerable?

Run nginx -v and compare against the fixed versions 1.30.6 or 1.31.7, or your distribution’s patched package. Use nginx -T to look for alias, rewrite, aio, ssi, map regex captures, HTTP/3, and session ticket settings that the advisories name as exposure conditions.

Can a DAST scanner find nginx vulnerabilities?

A DAST scanner will not tell you which nginx CVEs affect your binary; use version inventory for that. DAST tools such as DastPilot find exposed version headers, CORS mistakes, missing rate limits, exposed debug surfaces, and API flaws behind nginx that attackers combine with server vulnerabilities.