nginx fixes five flaws in October: checking and updating your web server

On 14 October 2026 the nginx project released versions 1.30.6 (stable) and 1.31.7 (mainline), fixing five security vulnerabilities. On 26 October Ubuntu shipped fixed packages with notice USN-8955-1; Debian did the same for Debian 13 with DSA-6575-1.

nginx is the web server, or proxy, that answers requests for a great many websites, business applications and web apps hosted on Linux servers. For a Ticino SME with a VPS or a dedicated server the practical question is simple: is the installed version the fixed one? Answering it takes a little care, because the version number shown by Linux distributions is easily misleading.

What was fixed

According to the nginx security advisories, the five flaws concern specific features or configuration combinations, not every installation:

The ratings differ, and it helps to understand why:

• nginx rates all five flaws as medium severity, because specific configurations are required.
• F5, the company that develops nginx and assigned the CVEs, gives three of them a CVSS 3.1 score of 8.1 (high), as listed in the NVD database: in the worst cases an attacker without credentials can crash nginx processes and, if the system’s memory protections (ASLR) are disabled or bypassed, reach code execution.
• The TLS ticket flaw (CVE-2026-97629) can allow client certificate verification to be bypassed, a mechanism used mainly for restricted access and system-to-system interfaces.

According to NVD data, CISA’s assessment of 15 October reported no known exploitation, and as of 9 November none of the five flaws is in the catalog of exploited vulnerabilities. There is no reason for alarm, but no reason to wait either: this is an update to schedule soon.

One figure puts the topic in context: in 2026 nginx has already published 26 security advisories. Updating the web server is a routine task, not an exceptional one.

The detail to know: the version number

Linux distributions do not ship the latest nginx release; they patch the version they chose at the start of the system’s life cycle. On Ubuntu 24.04, for example, nginx -v still shows 1.24.0 after the update: the fix is in the full package version. To know whether a server is fixed you therefore compare the package version with the one in your distribution’s advisory.

Versions of the nginx package listed as fixed (excerpt):

Hosting control panels and container images (Docker) often include their own copy of nginx: in that case what matters is the version of the panel or image, not that of the operating system.

What to do with your server

1. Know where nginx runs. Not only on the website server: nginx is often used as a proxy in front of business applications, web apps or containers. List the systems involved.
2. Check the package version. On Ubuntu and Debian with apt policy nginx or by asking your provider, and compare it with the table above or with your distribution’s advisory.
3. Update and restart the service. Install the distribution’s security update, or 1.30.6 or later if nginx comes from the official nginx.org packages, and check that the service has actually been restarted. For container images: update the image and recreate the container.
4. If the update is not yet available (for example on Debian 12 at the time of publication): have whoever runs the server review the configuration. The flaws depend on specific features (HTTP/3, SSI with asynchronous I/O, client certificates, certain combinations of alias and rewrite): disabling what is not needed reduces exposure until the fix arrives.
5. Check the logs. In the nginx error log, unexpected restarts of worker processes can signal failed attempts or a problem worth investigating.

We do not publish details on how to exploit these flaws: the goal is to update and verify systems. We have also covered Ubuntu and Debian server updates in our article on the APT flaw.

If the server was compromised: reporting

• Data protection (FADP). If the server holds personal data (customers, forms, accounts) and the breach is likely to result in a high risk for the people concerned, article 24 of the Federal Act on Data Protection requires notifying the FDPIC as soon as possible. The FDPIC guidelines explain how to assess the case.
• NCSC. For most SMEs reporting a cyber incident to the National Cyber Security Centre (NCSC) is voluntary but useful. Since 1 April 2025, operators of critical infrastructure have a reporting obligation for cyberattacks within 24 hours of discovery.
• Financial damage. If you suffer a loss, file a complaint with the cantonal police.

Frequently asked questions

Our site is on shared hosting: do we need to do anything?

The server is run by the provider, who has to apply the updates. It is still worth asking in writing whether the web server uses nginx and whether the October updates have been installed.

Our server runs Apache: are we affected?

These flaws concern nginx only. Many setups, however, use nginx as a proxy in front of Apache or other applications: it is worth checking.

nginx -v shows an old version: is the server vulnerable?

Not necessarily. On Linux distributions what counts is the full package version, which includes the fixes backported by the distribution. If it matches the advisory, the server is fixed.

We use neither HTTP/3 nor SSI: can we skip the update?

No. The flaws involve different features and it is easy to underestimate what a configuration that has grown over the years contains. Updating is the simplest way to close all five flaws at once.

Our approach

ElaraTeq Sagl helps SMEs and practices in Ticino run and update Linux and web servers, host in Switzerland and configure TLS (hosting, consulting; on TLS see also 100-day certificates). To have your server checked you can contact us.

Sources

• nginx, nginx security advisories
• nginx, Changes with nginx 1.30.6, 14 October 2026
• NIST NVD, CVE-2026-15176, CVE-2026-93479, CVE-2026-95101, CVE-2026-97629, CVE-2026-97205
• Ubuntu, USN-8955-1: nginx vulnerabilities, 26 October 2026
• Debian, DSA-6575-1 nginx – security update and CVE-2026-15176 tracker
• NCSC, Reporting obligation for cyberattacks on critical infrastructure
• FDPIC, Guidelines on data breaches