NGINX: check the release and the directives in use

Match the fix to the product and branch

CERT-FR advisory CERTFR-2026-AVI-1341, dated October 19, covers several F5 products. For NGINX Open Source, it lists releases before 1.30.6 and versions in the 1.31.x branch before 1.31.7. For NGINX Plus, the listed update points are 37.0.5.1 and 37.1.0.1, depending on the branch. There is no single update number for the entire product range.

The same advisory also names Ingress controllers, Gateway Fabric and application-protection products. Identify the component actually installed. If a hosting provider maintains it, ask for confirmation that it has addressed the advisory rather than changing a package or image without knowing its role.

Three flaws with different prerequisites

The F5 descriptions in the NVD records do not describe an attack that works against every server named NGINX. They identify specific configurations, including the following.

• CVE-2026-15176: alias combined with rewrite and particular uses of $request_filename, including through set, return or the access log format.
• CVE-2026-97205: asynchronous file I/O (AIO) enabled in certain configurations, together with processing an SSI page containing include virtual commands.
• CVE-2026-93479: a map directive using regex matching and reuse of its capture variables under certain conditions; the description also identifies a case involving a non-cacheable variable.

Debian adds HTTP/3 and TLS session tickets

Debian’s October 21 DSA-6575-1 covers five CVEs and lists 1.26.3-3+deb13u10 as the fixed trixie package. Its 1.26.3 prefix does not negate backported fixes. Alongside the three flaws above, it includes CVE-2026-95101 and CVE-2026-97629.

For CVE-2026-95101, F5’s NVD description specifies HTTP/3 with proxy_request_buffering on: an unauthenticated attacker may inject data into the proxied request. For CVE-2026-97629, it describes ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key file. Non-deterministic forged TLS sessions may allow client-certificate verification to be bypassed.

NGINX Plus requires another distinction: for CVE-2026-95101, F5’s affected-version boundaries are 37.0.7.1 and 37.2.0.1, depending on the branch. Do not treat 37.0.5.1 or 37.1.0.1, listed for other fixes, as covering every issue.

Check the server without breaking its gateway role

Record the product, branch, deployed package or image, and who maintains it. Prepare the appropriate fix, with a configuration backup and a way to restore usable service. Afterwards, check the sites and applications that pass through the server, not just its home page.

Do not remove a random directive as a makeshift patch: your file paths, application or logs may depend on it. The technical prerequisites help assess exposure; they do not replace addressing the advisory for the installed release.

• Self-hosting: who maintains exposed components?↗

Not evidence of active exploitation

The three NVD records we consulted have Awaiting Analysis status. Their technical descriptions are attributed to F5. The CISA Coordinator markings they contain, dated October 15, say exploitation: none. This does not prove that no attack exists; we are not describing these flaws as actively exploited.

SecuFocus has not reproduced the attacks or validated an NGINX configuration. We did not open F5 bulletins outside our authorised news-source list. The versions come from CERT-FR and the prerequisites from the three NVD records, rather than solely from the press article that surfaced the story.