⚡ 情报报告

NGINX 修复 5 个漏洞，包括可能的 RCE 和可能跳过客户端证书检查的 TLS 漏洞

📰 The Hacker News 🕐 Oct 15, 2026 12:58 ⏱ 1 分钟阅读 ⚠️ 10 个漏洞

NGINX 于 10 月 14 日发布了 1.30.6 和 1.31.7 版本，以修复五个漏洞，其中一个自 2005 年 5 月以来的每个版本中都存在。

F5（NGINX 的母公司）表示，有三个内存漏洞可能导致工作进程崩溃或让攻击者运行代码，每个漏洞都需要特定的配置来利用。

第四个漏洞允许攻击者伪造一个 TLS 会话，可能绕过客户端证书检查，尽管 F5 称这种伪造是非确定性的，超出了攻击者的控制。第五个漏洞允许 HTTP/3 客户端在请求中插入额外字节，NGINX 将其转发给后端。

截至 10 月 15 日，这五个漏洞均未列入 CISA 的已知利用漏洞目录，NGINX 和 F5 也未报告任何攻击。NGINX 将这五个漏洞的严重性评为中等。F5 将三个内存漏洞的 CVSS v4.0 分数评为 9.2（严重），TLS 漏洞为 8.3，HTTP/3 漏洞为 6.9。

哪些配置是暴露的

这五个漏洞都需要您添加的指令：带重写的别名、正则表达式映射、启用 AIO 的 SSI、共享 TLS 会话缓存或 HTTP/3。NGINX 自身的文档推荐使用共享会话缓存和请求缓冲；HTTP/3 漏洞的其他条件默认开启。

TLS 漏洞存在于会话票据密钥的自动轮换中。会话票据允许客户端在不进行完整握手的情况下恢复 TLS 会话，自 2022 年 10 月的 1.23.2 版本起，共享会话缓存使 NGINX 自行生成和轮换票据密钥，除非您从文件加载密钥。

每个工作进程保留三个密钥槽的副本。轮换只复制了两个，因此第三个槽保持了之前内存中的内容，而命名该槽的票据可以用未初始化的密钥材料进行验证和解密，“允许伪造会话”，修复提交中提到。

F5 表示，伪造以“超出攻击者控制的非确定性方式”工作，攻击者可以利用它绕过客户端证书的验证。暴露的设置是 ssl_session_cache shared:SSL:10m，这是 NGINX 文档中示例配置所使用的。NGINX 在 2025 年 2 月修复了一个具有相同后果的会话重用漏洞 CVE-2025-23419。

以下条件和解决方法来自 NGINX 和 F5。版本范围来自 NGINX 的安全公告页面。

漏洞

允许的操作

暴露的配置

受影响的版本

如果无法升级（F5）

CVE-2026-15176

工作进程中的堆溢出：崩溃，可能执行代码

带别名的 location，重写更改 URI，以及任何读取 $request_filename 的操作（return、set、if、add_header 或访问日志格式）

0.1.29 到 1.31.6

不要在该位置使用别名。不要使用 $request_filename。

CVE-2026-93479

工作进程中的堆溢出：崩溃，可能执行代码

正则表达式映射，其捕获在映射输出变量之前被 root 或 log_format 引用

1.30.0 到 1.30.5 和 1.31.2 到 1.31.6

使用命名捕获，并仅在与正则匹配的块内使用它们。

CVE-2026-97205

工作进程中的使用后释放：崩溃，内存损坏，可能执行代码

启用 aio 和带有 include virtual 命令的 SSI 页面，在某些配置中

0.8.11 到 1.31.6

关闭 aio，或不提供 SSI 页面。

CVE-2026-95101

额外字节注入到代理请求中，或请求体超出 client_max_body_size

HTTP/3 与

proxy_request_buffering on

，默认设置

1.25.0 到 1.31.6

将 proxy_request_buffering 设置为 off。

CVE-2026-97629

伪造的 TLS 会话可能绕过客户端证书验证（F5 称为非确定性且超出攻击者控制）

ssl_session_cache shared:... 没有

ssl_session_ticket_key

，开启自动密钥轮换

1.23.2 到 1.31.6

删除共享缓存指令，或使用 ssl_session_ticket_key 从文件加载密钥。关闭 ssl_session_tickets 的服务器不受影响。

一个漏洞追溯到 7 月的修复

映射漏洞 CVE-2026-93479 存在于 NGINX 于 7 月 15 日为 CVE-2026-42533 修补的字符串处理代码中，该漏洞是通过正则表达式映射的捕获达到的，F5 将其评分为 9.2。

根据修复提交，新的溢出在 7 月发布的更改后变得可能。7 月的补丁增加了防止缓冲区溢出的保护，但数据仍可能溢出到保留区域，随后第二个 7 月补丁根据溢出长度调整了最终字符串的大小，因此字符串可能超出其缓冲区。

提交对其设置了限制。溢出最多为文档根路径上保留区域的大小，以及访问日志路径上的单个空字节。

F5 的安全公告和 NGINX 的安全公告页面将 1.30.0 和 1.31.2 列为最早受影响的版本，这些版本在 7 月的更改之前。无论如何，7 月修补的服务器都在受影响范围内。

F5 的 7 月解决方法已经受到质疑。研究人员 Stan Shaw 在 7 月告诉《黑客新闻》，切换到命名捕获留下了更窄的路径，并且升级是“唯一的完整修复”。

别名、AIO 和 HTTP/3 漏洞的修复提交描述了其他三个漏洞。别名漏洞在重写更改请求的 URI 之后和 NGINX 选择下一个位置之前的瞬间打开。如果在该窗口内有任何读取 $request_filename 的操作，并且位置的前缀长于重写的 URI，则将 URI 映射到文件路径时会导致缓冲区溢出。

AIO 漏洞是一个计数器。每个请求上的待处理异步操作会在一个没有检查的 8 位字段中加一，因此 256 个待处理操作将其包裹为零，而请求可以在这些操作仍然指向其内存时被释放。NGINX 将带有 include virtual 命令的 SSI 页面命名为触发器，这些页面可以并行运行其包含的请求。

HTTP/3 漏洞源于一个解析器字段执行两个任务：保持被跳过的未知帧的剩余长度，以及作为请求体传递的 DATA 字节数。当未知帧被拆分为两个读取时，剩余计数被视为请求体并发送到后端，超出了 client_max_body_size 检查。

相关漏洞

CVE-2026-97629 CVSS 8.3 HIGH Awaiting Analysis

CVE-2026-97629 - NGINX ngx_http_ssl_module vulnerability

Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-deterministic manner that is beyond the attacker's control. An attacker could leverage this vulnerability to bypass verification of client certificates. Impact This vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-97205 CVSS 9.2 CRITICAL Awaiting Analysis

CVE-2026-97205 - NGINX ngx_http_core_module vulnerability

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-95101 CVSS 6.9 MEDIUM Awaiting Analysis

CVE-2026-95101 - NGINX ngx_http_v3_module vulnerability

Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with proxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request. Impact This vulnerability may allow remote attackers to inject data in the proxied request. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-93479 CVSS 9.2 CRITICAL Awaiting Analysis

CVE-2026-93479 - NGINX map directive and regex matching vulnerability

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-15176 CVSS 9.2 CRITICAL Awaiting Analysis

CVE-2026-15176 - NGINX ngx_http_core_module vulnerability

A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-101025 CVSS 6.9 MEDIUM Awaiting Analysis

CVE-2026-101025 - NGINX ngx_http_js_module vulnerability

Description NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse() fails. The failure path did not register cleanup and the context was not released for the lifetime of the process. An unauthenticated attacker may send requests with malformed XML and can cause unbounded memory growth in long-lived NGINX worker processes. Impact This vulnerability may allow remote attackers to send requests that trigger repeated parsing of malformed XML and may lead to NGINX worker termination or denial of service. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-101019 CVSS 8.3 HIGH Awaiting Analysis

CVE-2026-101019 - NGINX ngx_http_js_module vulnerability

Description NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends during the canonicalization process, the $attr$Name getter may return undefined for an explicitly present attribute containing an internal entity reference. The $attrs getter may return a value derived only from the first attribute child. This may allow an unauthenticated attacker that invests significant effort in obtaining a genuinely signed document to skip validation while signature verification succeeds. An nginx-saml deployment is a confirmed affected consumer when run with the built-in njs backend. Impact In affected signed-XML consumers, an unauthenticated attacker can cause security-relevant attributes to appear absent or truncated while signature verification succeeds. In nginx-saml, this can bypass expiry, Destination, and request-correlation checks, enabling replay or acceptance of a response outside its intended context. It does not permit signature or identity forgery, or a direct availability impact. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-42533 CVSS 9.2 CRITICAL Analyzed

CVE-2026-42533 - NGINX Map directive and Regex matching vulnerability

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-42945 CVSS 9.2 CRITICAL Modified

CVE-2026-42945 - NGINX ngx_http_rewrite_module vulnerability

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2025-23419 CVSS 5.3 MEDIUM Analyzed

CVE-2025-23419 - TLS Session Resumption Vulnerability

When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_ticket_key are used and/or the SSL session cache https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache are used in the default server and the default server is performing client certificate authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NGINX 修复 5 个漏洞，包括可能的 RCE 和可能跳过客户端证书检查的 TLS 漏洞

相关漏洞

更多来自 The Hacker News