[{"data":1,"prerenderedAt":218},["ShallowReactive",2],{"seo-verification":3,"blog-nginx-cve-2026-15176-audit-and-patch-to-1-30-6-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"key":7,"data":8},"blog-nginx-cve-2026-15176-audit-and-patch-to-1-30-6-en",{"id":9,"slug":10,"slugs":11,"title":15,"excerpt":16,"readTime":17,"views":18,"isPinned":19,"publishedAt":20,"updatedAt":21,"category":22,"categories":28,"featuredImage":30,"bgImage":31,"posterImage":32,"relatedSolution":30,"intro":33,"sections":34,"ctaTitle":161,"ctaBody":162,"ctaButton":163,"ctaUrl":164,"relatedPosts":165},492,"nginx-cve-2026-15176-audit-and-patch-to-1-30-6",{"fr":12,"en":10,"ar":13,"es":14},"nginx-cve-2026-15176-mettre-a-jour","ثغرة-nginx-cve-2026-15176-الفحص-والتحديث-إلى-1-30-6","nginx-cve-2026-15176-auditar-y-actualizar-a-1-30-6","nginx CVE-2026-15176: audit and patch to 1.30.6","nginx 1.30.6 and 1.31.7 fix five flaws, including CVE-2026-15176. Affected versions, config audit commands, updates per system and mitigations.",12,0,false,"2026-10-22T00:00:00+00:00","2026-10-23T13:27:02+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},8,"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[29],{"id":23,"name":24,"slug":25,"color":26,"icon":27},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fnginx-cve-2026-15176-mettre-a-jour-poster.svg","On 14 October 2026, nginx released versions 1.30.6 (stable) and 1.31.7 (mainline), which fix five vulnerabilities, including CVE-2026-15176. Each one only affects specific configurations: alias combined with rewrite, regex captures, HTTP\u002F3, TLS session ticket key rotation, SSI with AIO. On a fleet of client servers, the real question is not \"are my servers up to date?\" but \"which machines are exposed, and in what order should I handle them?\". This guide gives you the commands to answer that in under an hour, then to fix each environment while keeping downtime to a few seconds.",[35,39,49,84,87,115,118,145,148,152,155,158],{"type":36,"title":37,"body":38},"h2","What nginx 1.30.6 and 1.31.7 fix","Both versions came out on the same day, 14 October 2026, on the nginx.org news page. They fix five flaws in the worker process: three memory corruptions, a data injection into the body of HTTP\u002F3 requests, and a TLS session forgery. A 1.31.8 mainline version followed on 21 October 2026; its announcement mentions no vulnerability, but it succeeds 1.31.7 and therefore contains its fixes.\n\nOn severity, two readings coexist, and they must be quoted as published. The nginx.org security advisories page rates all five flaws as \"medium\". The CVE records published by F5, the vendor behind nginx, give three of them a CVSS 3.1 score of 8.1. They spell out the scenario: the worker crashes and restarts, and code execution remains possible if ASLR is disabled or bypassed. All of them require a specific configuration to be exploitable. That is what makes the inventory worthwhile: on a fleet, some servers are simply not affected.",{"type":40,"title":41,"items":42},"ul","The five flaws and what exposes you",[43,44,45,46,47,48],"**CVE-2026-15176, alias and rewrite** — heap overflow in the worker when a `location` combines `alias`, `rewrite` and a `set` or `return` directive that reads `$request_filename`, or when `$request_filename` appears in a `log_format`. Vulnerable range: 0.1.29 to 1.31.6.","**CVE-2026-93479, strings with variables** — overflow while computing the document root or writing logs, typically a regex `map` whose captures `$1`, `$2` are read by `root` or a `log_format` before the output variable. Vulnerable range: 1.30.0 to 1.30.5 and 1.31.2 to 1.31.6.","**CVE-2026-95101, HTTP\u002F3 request body** — part of an unknown frame may be read as request body: bypass of `client_max_body_size` or injection into the proxied request, with `proxy_request_buffering on`, the default value. Vulnerable range: 1.25.0 to 1.31.6.","**CVE-2026-97629, TLS session tickets** — with `ssl_session_cache shared:…` and no `ssl_session_ticket_key`, nginx rotates its keys itself; one of them was left uninitialized, which allows forging a session and, according to F5, bypassing client certificate verification. Vulnerable range: 1.23.2 to 1.31.6.","**CVE-2026-97205, SSI with AIO** — use-after-free when `aio` is enabled and an SSI page contains `include virtual` commands. Vulnerable range: 0.8.11 to 1.31.6.","**Published severity** — \"medium\" for all five on nginx.org. According to F5's CVE records, the CVSS 3.1 score is 8.1 for CVE-2026-15176, CVE-2026-93479 and CVE-2026-97205, 6.5 for CVE-2026-97629 and 5.3 for CVE-2026-95101.",{"type":50,"title":51,"headers":52,"rows":56},"comparison","Affected and fixed versions",[53,54,55],"Flaw or package","Vulnerable versions","Fixed in",[57,61,64,67,70,73,77,81],[58,59,60],"CVE-2026-15176 — alias and rewrite","0.1.29 to 1.31.6","1.30.6 and 1.31.7",[62,63,60],"CVE-2026-93479 — strings with variables","1.30.0 to 1.30.5, 1.31.2 to 1.31.6",[65,66,60],"CVE-2026-95101 — HTTP\u002F3","1.25.0 to 1.31.6",[68,69,60],"CVE-2026-97629 — TLS tickets","1.23.2 to 1.31.6",[71,72,60],"CVE-2026-97205 — SSI with AIO","0.8.11 to 1.31.6",[74,75,76],"Debian 13 package (trixie)","Packages older than `1.26.3-3+deb13u10`","`1.26.3-3+deb13u10` (DSA-6575-1)",[78,79,80],"Debian 12 package (bookworm)","Marked vulnerable as of 22 October 2026","Not published yet",[82,83,80],"Ubuntu packages","\"Needs evaluation\" as of 22 October 2026",{"type":36,"title":85,"body":86},"Distro package or Docker: the version number is not enough","This is the most common objection on a mixed fleet: `nginx -v` shows 1.26.3 or 1.22.1, far below 1.30.6, and yet the machine may well be fixed. Distributions backport security fixes into their own branch without changing the upstream number: only the package suffix moves. Debian did this for trixie with advisory DSA-6575-1, which covers all five CVEs. Conversely, as of 22 October 2026, the Debian security tracker still marked bookworm as vulnerable, and Ubuntu showed \"Needs evaluation\" for all of its tracked releases.\n\nThe only reliable check is therefore the changelog of the installed package: `zgrep -l CVE-2026-15176 \u002Fusr\u002Fshare\u002Fdoc\u002Fnginx*\u002Fchangelog.Debian.gz` on Debian or Ubuntu, `rpm -q --changelog nginx | grep CVE-2026-15176` on RHEL, AlmaLinux or Rocky. A matching line means the fix has been backported; nothing at all means it has not been yet. For Docker, the tag is what matters: the official `nginx:1.30.6` and `nginx:1.31.7` images are live on Docker Hub, and an image pinned to an older tag stays vulnerable until it is replaced.",{"type":88,"title":89,"steps":90},"steps","Audit a server's exposure in ten minutes",[91,94,97,100,103,106,109,112],{"title":92,"body":93},"Record the version and the source","`nginx -v` gives the binary version. Where the package comes from decides how you update it:\n`apt-cache policy nginx` on Debian or Ubuntu (nginx.org repository or distribution)\n`rpm -qi nginx | grep -E 'Version|Release|Vendor'` on RHEL and derivatives\nIf nginx runs in a container: `docker ps | grep -i nginx`.",{"title":95,"body":96},"List the compiled modules","`nginx -V 2>&1 | tr ' ' '\\n' | grep -E 'http_v3|ssi|threads|file-aio'`\nWithout `--with-http_v3_module`, CVE-2026-95101 does not concern you. The SSI module is built by default: only the `--without-http_ssi_module` option excludes it.",{"title":98,"body":99},"Export the effective configuration","`sudo nginx -T > \u002Froot\u002Fnginx-conf.txt 2>&1`\n`nginx -T` tests the configuration and prints all of it, included files too. Query this file rather than browsing `\u002Fetc\u002Fnginx` by hand: one forgotten `include` is enough to miss a directive.",{"title":101,"body":102},"Look for alias and $request_filename (CVE-2026-15176)","`grep -nE '^\\s*(alias|rewrite)\\s' \u002Froot\u002Fnginx-conf.txt`\n`grep -n 'request_filename' \u002Froot\u002Fnginx-conf.txt`\nYou are exposed if one `location` combines `alias`, `rewrite` and a `set` or `return` that reads `$request_filename`, or if a `log_format` contains that variable.",{"title":104,"body":105},"Look for regex maps (CVE-2026-93479)","`grep -nA8 '^\\s*map ' \u002Froot\u002Fnginx-conf.txt`\nSpot the entries starting with `~`, then look for `$1`, `$2` in `root` and `log_format` directives. This flaw only affects the 1.30 and 1.31 branches: a server on 1.28 or below is not concerned.",{"title":107,"body":108},"Check HTTP\u002F3 (CVE-2026-95101)","`grep -nE 'listen\\s.*quic|http3' \u002Froot\u002Fnginx-conf.txt`\n`grep -n 'proxy_request_buffering' \u002Froot\u002Fnginx-conf.txt`\nHTTP\u002F3 enabled in front of a `proxy_pass`, without `proxy_request_buffering off`: exposed.",{"title":110,"body":111},"Check TLS tickets (CVE-2026-97629)","`grep -nE 'ssl_session_cache\\s.*shared|ssl_session_ticket_key|ssl_session_tickets' \u002Froot\u002Fnginx-conf.txt`\nExposed if `shared:` is present without `ssl_session_ticket_key` or `ssl_session_tickets off`. The impact described by F5 mainly concerns sites that authenticate clients by certificate (`ssl_verify_client`).",{"title":113,"body":114},"Check SSI and AIO (CVE-2026-97205)","`grep -nE '^\\s*(ssi|aio)\\s' \u002Froot\u002Fnginx-conf.txt`\nExposed if `ssi on` and `aio` (value `on` or `threads`) apply to the same pages, and those pages contain `include virtual` commands.",{"type":36,"title":116,"body":117},"In what order to handle a fleet of servers","With these eight checks, every server lands in one of three boxes. First box: an exposure condition is present and the server receives public traffic. It gets patched today, or receives a mitigation within the hour. Reverse proxies serving HTTP\u002F3 and sites authenticating by client certificate come first, because the described impact hits the proxied request or the authentication itself.\n\nSecond box: no condition is present, but the version is in the vulnerable range. The immediate risk is low, and the update is scheduled within the week. Configurations change, and an `alias` added tomorrow by a developer is enough to reopen CVE-2026-15176.\n\nThird box: version already fixed, or a distribution package whose changelog cites the CVEs. Nothing to do, except recording the date of the check. Keep this table per client: it is also the answer to give when a client asks whether they were affected.",{"type":88,"title":119,"steps":120},"Update environment by environment",[121,124,127,130,133,136,139,142],{"title":122,"body":123},"nginx.org repository on Debian or Ubuntu","`sudo apt update && sudo apt install --only-upgrade nginx`\nThen `nginx -v` must show 1.30.6 on the stable branch, 1.31.7 or newer on mainline.",{"title":125,"body":126},"nginx.org repository on RHEL, AlmaLinux or Rocky","`sudo dnf upgrade nginx`\nSame check with `nginx -v`. For both families, the repository setup is described on the nginx.org Linux packages page.",{"title":128,"body":129},"Distribution package","On Debian 13, `sudo apt update && sudo apt install --only-upgrade nginx` must bring `1.26.3-3+deb13u10` or newer. Elsewhere, apply security updates as soon as they are released and check the changelog as shown above. If your distribution lags behind, switching to the nginx.org repository is possible; first make sure the dynamic modules you depend on exist there.",{"title":131,"body":132},"Docker containers","In the compose file, pin `image: nginx:1.30.6` (or `nginx:stable`), then:\n`docker compose pull && docker compose up -d`\nAn image built `FROM nginx:…` must be rebuilt: `docker compose build --pull && docker compose up -d`.",{"title":134,"body":135},"Server managed by a panel or a hosting provider","If nginx was installed by an administration panel or by your hosting provider, their update channel delivers the fix. Check `nginx -v` and the package changelog after their update and, if in doubt, ask the provider on which date the fix was applied.",{"title":137,"body":138},"Test the configuration","`sudo nginx -t`\nThe expected answer contains `syntax is ok` and `test is successful`. Never restart without this test: an invalid configuration leaves the service stopped.",{"title":140,"body":141},"Replace the binary in memory","Updating the package does not replace the master process already running. `sudo ls -l \u002Fproc\u002F$(cat \u002Frun\u002Fnginx.pid)\u002Fexe` shows `(deleted)` as long as the old binary is running (adjust the PID file path). `sudo systemctl restart nginx` cuts traffic for a few seconds; on-the-fly replacement with the `USR2` signal, documented by nginx, avoids that cut but requires a good knowledge of your systemd setup.",{"title":143,"body":144},"Check, then monitor","Run `nginx -v` and the `\u002Fproc` command again: no more `(deleted)`. Test a site with `curl -sI https:\u002F\u002Fyour-domain.com`. Then add an alert on worker restarts, as in our guide \u003Ca href=\"\u002Fblog\u002Fmonitoring-alerte-proactif-self-hosted-vps\">proactive monitoring and alerting on a VPS\u003C\u002Fa>.",{"type":36,"title":146,"body":147},"Cannot patch today: the mitigations published by F5","F5's CVE records describe a mitigation for each of the five flaws. They remove the exposure condition without fixing the code: they are stopgap measures.\n\n**CVE-2026-15176**: do not use `alias` in the affected `location`, or do not use `$request_filename`.\n**CVE-2026-93479**: replace unnamed captures with named captures, such as `(?\u003Csite>…)`, and limit their use to the block where the regex applies.\n**CVE-2026-95101**: `proxy_request_buffering off;`. Upload bodies are then streamed to the application, which changes its behaviour on large files.\n**CVE-2026-97629**: remove `ssl_session_cache shared:…`, or load static keys with `ssl_session_ticket_key` (file created by `openssl rand 80 > \u002Fetc\u002Fnginx\u002Fticket.key`). Servers running `ssl_session_tickets off;` are not affected.\n**CVE-2026-97205**: disable `aio`, or stop serving SSI pages.\n\nEach mitigation is validated with `nginx -t` then `systemctl reload nginx`. A reload is enough here, since the binary does not change.",{"type":149,"title":150,"body":151},"tip","Detection: clues, not proof","A crashing worker leaves a line such as `worker process 12345 exited on signal 11` in the error log. Count them with `grep -c 'exited on signal' \u002Fvar\u002Flog\u002Fnginx\u002Ferror.log` and compare with previous weeks. Repeated crashes on an exposed server are a clue worth investigating, not proof of compromise; their absence is not proof of safety either. General measure, outside the vendor advisory: restrict at the firewall the vhosts that do not need to be public, as detailed in our \u003Ca href=\"\u002Fblog\u002Flinux-hardening-vps-checklist\">Linux VPS hardening checklist\u003C\u002Fa>.",{"type":36,"title":153,"body":154},"Troubleshooting: errors that follow the update","**`nginx -v` shows 1.30.6, but nothing has changed.** The binary on disk is new, the master process is the old one. The command `ls -l \u002Fproc\u002F\u003Cpid>\u002Fexe` shows it with the `(deleted)` mark. Fix: restart the service, or replace it on the fly with `USR2`.\n\n**`nginx: [emerg] \"\u002Fetc\u002Fnginx\u002Fticket.key\" must be 48 or 80 bytes`.** The ticket key file does not have the right size, often because it was created in base64 or with a trailing newline. Fix: `openssl rand 80 > \u002Fetc\u002Fnginx\u002Fticket.key`, without any encoding option, then `nginx -t`.\n\n**`nginx is already the newest version`.** Your distribution's repository does not offer a fixed package yet. Fix: apply the mitigations above and follow the distribution's security tracker, or move to the nginx.org repository.\n\n**The container still answers with the old version.** The image was pulled, but the container was not recreated, or the service points to a pinned tag. Fix: `docker compose up -d --force-recreate`, then `docker compose exec \u003Cservice> nginx -v`.",{"type":36,"title":156,"body":157},"Five flaws on twenty servers: an agency's workload","For an agency, this fix is not one command: it is a tour of the fleet. One server per client, different sources (a Debian package here, the nginx.org repository there, a Docker image elsewhere), configurations written by several people. Each machine needs the inventory, the update, the restart, the check, then the answer to the worried client.\n\nThe most durable way to reduce this workload is to reduce the number of web servers you administer yourself. With ServOrbit.com reseller hosting, your clients' sites run in cPanel accounts you manage from WHM, under your own brand: you keep the client relationship and your prices, we run the infrastructure. For machines that must stay with root access, the administration option is available on our \u003Ca href=\"\u002Fvps-cloud\">Cloud VPS\u003C\u002Fa>. And if you are still weighing the reverse proxy for these machines, our \u003Ca href=\"\u002Fblog\u002Fchoisir-reverse-proxy-vps-caddy-traefik-nginx\">Caddy, Traefik and nginx comparison\u003C\u002Fa> sets out the criteria.",{"type":36,"title":159,"body":160},"The official documentation","\u003Ca href=\"https:\u002F\u002Fnginx.org\u002F\">nginx.org — news of 14 October 2026\u003C\u002Fa>\n\u003Ca href=\"https:\u002F\u002Fnginx.org\u002Fen\u002Fsecurity_advisories.html\">nginx security advisories\u003C\u002Fa>\n\u003Ca href=\"https:\u002F\u002Fnginx.org\u002Fen\u002FCHANGES-1.30\">CHANGES-1.30\u003C\u002Fa>\n\u003Ca href=\"https:\u002F\u002Fwww.cve.org\u002FCVERecord?id=CVE-2026-15176\">CVE-2026-15176\u003C\u002Fa> · \u003Ca href=\"https:\u002F\u002Fwww.cve.org\u002FCVERecord?id=CVE-2026-93479\">CVE-2026-93479\u003C\u002Fa> · \u003Ca href=\"https:\u002F\u002Fwww.cve.org\u002FCVERecord?id=CVE-2026-95101\">CVE-2026-95101\u003C\u002Fa> · \u003Ca href=\"https:\u002F\u002Fwww.cve.org\u002FCVERecord?id=CVE-2026-97629\">CVE-2026-97629\u003C\u002Fa> · \u003Ca href=\"https:\u002F\u002Fwww.cve.org\u002FCVERecord?id=CVE-2026-97205\">CVE-2026-97205\u003C\u002Fa>\n\u003Ca href=\"https:\u002F\u002Fsecurity-tracker.debian.org\u002Ftracker\u002FDSA-6575-1\">Debian DSA-6575-1\u003C\u002Fa> · \u003Ca href=\"https:\u002F\u002Fubuntu.com\u002Fsecurity\u002FCVE-2026-15176\">Ubuntu CVE-2026-15176\u003C\u002Fa>\n\u003Ca href=\"https:\u002F\u002Fnginx.org\u002Fen\u002Flinux_packages.html\">nginx.org — Linux packages\u003C\u002Fa> · \u003Ca href=\"https:\u002F\u002Fnginx.org\u002Fen\u002Fdocs\u002Fcontrol.html\">Controlling nginx\u003C\u002Fa> · \u003Ca href=\"https:\u002F\u002Fnginx.org\u002Fen\u002Fdocs\u002Fhttp\u002Fngx_http_ssl_module.html\">ngx_http_ssl_module\u003C\u002Fa>","Fewer web servers to patch yourself","With ServOrbit.com reseller hosting, your clients' sites run under your brand, on infrastructure we look after. You keep the client relationship and your prices; we keep the server layer.","Explore the agency offer","\u002Fsolutions\u002Fagences",[166,183,203],{"id":167,"slug":168,"slugs":169,"title":173,"excerpt":174,"readTime":175,"views":176,"isPinned":19,"publishedAt":177,"updatedAt":178,"category":179,"categories":180,"featuredImage":30,"bgImage":31,"posterImage":182,"relatedSolution":30},317,"linux-vps-hardening-checklist-for-agencies",{"fr":170,"en":168,"ar":171,"es":172},"linux-hardening-vps-checklist","قائمة-تصليب-خادم-لينكس-للوكالات-بعد-التسليم","hardening-linux-vps-checklist-para-agencias-tras-la-entrega","Linux VPS Hardening Checklist for Agencies","Reproducible Linux hardening checklist for agencies: auditd, sudo user, SSH key auth, UFW, fail2ban and root lockout — with per-client traceability.",11,1,"2026-08-30T00:00:00+00:00","2026-09-07T11:26:10+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[181],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Flinux-hardening-vps-checklist-poster.svg",{"id":184,"slug":185,"slugs":186,"title":190,"excerpt":191,"readTime":192,"views":193,"isPinned":19,"publishedAt":194,"updatedAt":178,"category":195,"categories":200,"featuredImage":30,"bgImage":31,"posterImage":202,"relatedSolution":30},227,"caddy-traefik-or-nginx-proxy-manager-which-to-choose",{"fr":187,"en":185,"ar":188,"es":189},"choisir-reverse-proxy-vps-caddy-traefik-nginx","caddy-أم-traefik-أم-nginx-proxy-manager-أيهما-تختار","elegir-reverse-proxy-vps-caddy-traefik-nginx","Caddy, Traefik or Nginx Proxy Manager: which to choose?","Caddy, Traefik or Nginx Proxy Manager for your VPS? A practical comparison to choose the right reverse proxy for your Docker stack.",10,2,"2026-08-06T00:00:00+00:00",{"id":196,"name":197,"slug":198,"color":199,"icon":198},5,"Comparison","comparatif","bg-info\u002F10 text-info",[201],{"id":196,"name":197,"slug":198,"color":199,"icon":198},"\u002Fblog\u002Fcovers\u002Fchoisir-reverse-proxy-vps-caddy-traefik-nginx-poster.svg",{"id":204,"slug":205,"slugs":206,"title":210,"excerpt":211,"readTime":175,"views":18,"isPinned":19,"publishedAt":212,"updatedAt":213,"category":214,"categories":215,"featuredImage":30,"bgImage":31,"posterImage":217,"relatedSolution":30},440,"proactive-vps-monitoring-beszel-uptime-kuma-v2",{"fr":207,"en":205,"ar":208,"es":209},"monitoring-alerte-proactif-self-hosted-vps","مراقبة-استباقية-vps-beszel-uptime-kuma","monitorizacion-proactiva-vps-beszel-uptime-kuma-v2","Proactive VPS monitoring: Beszel and Uptime Kuma v2","Deploy Beszel and Uptime Kuma v2 on a VPS to monitor your entire server fleet and receive Telegram or SMTP alerts before your clients notice the outage.","2026-10-14T00:00:00+00:00","2026-10-14T23:33:30+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[216],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Fmonitoring-alerte-proactif-self-hosted-vps-poster.svg",1792763213838]