Security Nginx 1.31.7 Security Release (5 CVEs Fixed)

Nginx 1.31.7 mainline and 1.30.6 stable are out (14 Oct 2026) with fixes for five security vulnerabilities:

• a buffer overflow when the alias directive serves a URI changed by rewrite (CVE-2026-15176)
• a buffer overflow when evaluating string expressions with variables, affecting document root calculation and request logging (CVE-2026-93479)
• request body injection over HTTP/3 (CVE-2026-95101)
• session forgery when TLS session ticket keys are rotated (CVE-2026-97629)
• a use-after-free in the SSI module when used with asynchronous file I/O (CVE-2026-97205)

All 5 CVEs are fixed in both the mainline (1.31.7) and stable (1.30.6) branches. nginx rates all five as Medium severity.

---

Centmin Mod 132.00stable, 140.00beta01, and 141.00beta01 have all been updated to default to Nginx 1.31.7 for fresh installs. The previous Centmin Mod default was 1.31.6.

• Mainline branch: nginx 1.31.7 fixes all 5 CVEs.
• Stable branch: nginx 1.30.6 fixes all 5 CVEs.

Existing Centmin Mod users running older releases (e.g. 124.00stable or 130.00beta01) should first update to the latest Centmin Mod 132.00stable or 140.00beta01 release as outlined at https://community.centminmod.com/th...ase-with-almalinux-rocky-linux-support.25572/. Then run centmin.sh menu option 4 to update to Nginx 1.31.7 or 1.30.6.

For existing Centmin Mod 132.00stable, 140.00beta01, and 141.00beta01 users, just running cmupdate command will get you the latest updated code. Then run centmin.sh menu option 4 to update to Nginx 1.31.7 or 1.30.6. (141.00beta01 is the EL10 development branch; its thread is https://community.centminmod.com/threads/29603/.)

Code (Text):

--------------------------------------------------------
     Centmin Mod Menu 141.00beta01 centminmod.com
--------------------------------------------------------
1).  Centmin Install
2).  Add Nginx vhost domain
3).  NSD setup domain name DNS
4).  Nginx Upgrade / Downgrade
5).  PHP Upgrade / Downgrade
6).  MySQL User Database Management
7).  Persistent Config File Management
8).  PostgreSQL Server Management
9).  Option Being Revised (TBA)
10). Memcached Server Re-install
11). MariaDB MySQL Upgrade & Management
12). Zend OpCache Install/Re-install
13). Install/Reinstall Redis PHP Extension
14). SELinux disable
15). Install/Reinstall ImagicK PHP Extension
16). Change SSHD Port Number
17). Multi-thread compression: zstd,pigz,pbzip2,lbzip2
18). Suhosin PHP Extension install
19). Install FFMPEG and FFMPEG PHP Extension
20). NSD Install/Re-Install
21). Data Transfer
22). Add Wordpress Nginx vhost + Cache Plugin
23). Update Centmin Mod Code Base
24). Exit
--------------------------------------------------------
Enter option [ 1 - 24 ] 4
--------------------------------------------------------

Nginx Upgrade - Would you like to continue? [y/n] y
Current Nginx Version: 1.31.6

Install which version of Nginx? (version i.e. type 1.31.7): 1.31.7

Do you still want to continue? [y/n] y

• Nginx 1.31.7 changelog: https://nginx.org/en/CHANGES
• Nginx 1.30.6 changelog: https://nginx.org/en/CHANGES-1.30
• Nginx security advisories: nginx security advisories

 

Nginx 1.31.7 Security Bugs Explained

All five vulnerabilities affect both the mainline (1.31.x) and stable (1.30.x) branches. For Centmin Mod users, the two that matter most are CVE-2026-97629, because Centmin Mod's HTTPS vhosts use the exact TLS session setup it affects, and CVE-2026-93479, because every Centmin Mod nginx default from 1.31.2 through 1.31.6 falls in its vulnerable range. The other three need features Centmin Mod does not enable by default.

CVE-2026-97629 - Session Forgery with TLS Session Ticket Key Rotation (Medium)

Plain English: TLS session tickets let a returning visitor resume an earlier HTTPS session without a full handshake. The server encrypts each ticket with a secret key, and since nginx 1.23.2 it rotates those keys automatically when a shared ssl_session_cache is configured. In the rotation code, one of the keys was left uninitialized, so an attacker might be able to forge a session ticket that the server accepts.

• Vulnerability: One of the TLS session ticket keys was left uninitialized during key rotation, which might allow a session to be forged.
• Severity: Rated Medium by nginx.
• Affected Versions: nginx 1.23.2 through 1.31.6. 1.23.2 is the release that introduced automatic ticket key rotation for shared session caches.
• Fixed In: 1.31.7 and 1.30.6.
• Who Is Affected: HTTPS servers that use session tickets (on by default in nginx) with a shared session cache. Centmin Mod HTTPS sites do this by default. Centmin Mod's nginx.conf includes /usr/local/nginx/conf/ssl_include.conf at the http level, and that file sets ssl_session_cache shared:SSL:10m;, so the shared cache applies to every HTTPS server block. Vhosts created by centmin.sh menu options 2 and 22, nv, nvwp and acmetool.sh also set ssl_session_tickets on; explicitly. That makes this the priority reason to upgrade for anyone serving HTTPS directly from Centmin Mod Nginx.
• Temporary workaround (only if you can't upgrade yet): set ssl_session_tickets off; in every HTTPS server block and reload Nginx. Centmin Mod vhosts have an explicit ssl_session_tickets on; line, so change that line rather than adding a second one. Returning visitors can still resume sessions through the shared session cache. Upgrading to 1.31.7 or 1.30.6 is the real fix.
• Credit: PhiNode Labs.

CVE-2026-93479 - Buffer Overflow in String Expression Evaluation (Medium)

Plain English: Nginx builds many values at request time from string expressions that contain variables, such as the document root for a request or a line written to the access log. A bug in that evaluation could overflow a memory buffer inside the worker process, in both the http and stream modules. This bug arrived with nginx 1.31.2 and 1.30.0. Older nginx versions are not affected.

• Vulnerability: A buffer overflow in a worker process while evaluating string expressions with variables, affecting document root calculation and request logging in the http and stream modules.
• Severity: Rated Medium by nginx.
• Affected Versions: nginx 1.31.2 through 1.31.6, and 1.30.0 through 1.30.5.
• Fixed In: 1.31.7 and 1.30.6.
• Impact: Worker process memory corruption or crash.
• Who Is Affected: The changelog doesn't publish the exact trigger conditions. However, every Centmin Mod nginx default from 1.31.2 through 1.31.6 (1.31.2, 1.31.3, 1.31.5 and 1.31.6) is in the vulnerable range, and Centmin Mod vhost access logs use variable-based log formats (combined by default, or main_ext). Treat this as relevant to all Centmin Mod servers running nginx 1.31.2 to 1.31.6, or 1.30.0 to 1.30.5.
• Credit: Matt Suiche of Tolmo Inc.

CVE-2026-15176 - Buffer Overflow with alias + rewrite (Medium)

Plain English: The alias directive maps a URL location to a different directory on disk. If a request URI was changed by a rewrite and then mapped to a file path through alias, nginx could overflow a memory buffer while building that file path.

• Vulnerability: A buffer overflow in a worker process when using the alias directive if the request URI was changed by the rewrite directive and then mapped to a file path.
• Severity: Rated Medium by nginx.
• Affected Versions: nginx 0.1.29 through 1.31.6, which is essentially every nginx release.
• Fixed In: 1.31.7 and 1.30.6.
• Impact: Worker process memory corruption or crash.
• Who Is Affected: Only configs that combine alias locations with rewrite rules that send requests into them. Centmin Mod's default nginx.conf and vhost templates don't use alias, so default installs are not affected. If you've added your own alias locations (for example, for a shared static directory or an admin tool), check whether any rewrite sends requests into them.

CVE-2026-95101 - Request Body Injection in HTTP/3 (Medium)

Plain English: With HTTP/3, nginx might treat part of an unknown frame as request body data. That could let a client get around client_max_body_size limits, or inject extra data into the request nginx proxies to a backend.

• Vulnerability: When using HTTP/3, part of an unknown frame might be treated as the request body.
• Severity: Rated Medium by nginx.
• Affected Versions: nginx 1.25.0 through 1.31.6.
• Fixed In: 1.31.7 and 1.30.6.
• Impact: Bypass of client_max_body_size, or data injection into proxied requests (including requests passed to PHP-FPM).
• Who Is Affected: Only servers with HTTP/3 enabled. Centmin Mod compiles the HTTP/3 module only when you opt in: with NGINX_QUIC_SUPPORT='y' or AWS_LC_SWITCH='y' in your persistent config /etc/centminmod/custom_config.inc, or by entering quic or angie as the version at the menu option 4 Nginx version prompt. A vhost also has to listen ... quic. Check whether your build includes it with nginx -V 2>&1 | grep -o with-http_v3_module.
• Credit: Hansol Lee of GOTROOT.

CVE-2026-97205 - Use-After-Free in SSI with AIO (Medium)

Plain English: Server Side Includes (SSI) let HTML pages pull in other content with <!--#include virtual="..." --> tags. With asynchronous file I/O (AIO) enabled, some configurations could make nginx use memory after it had been freed while processing those includes.

• Vulnerability: A use-after-free when using asynchronous file I/O (AIO) in certain configurations if an SSI page has include virtual commands.
• Severity: Rated Medium by nginx.
• Affected Versions: nginx 0.8.11 through 1.31.6.
• Fixed In: 1.31.7 and 1.30.6.
• Impact: Worker process memory corruption or crash.
• Who Is Affected: Only servers that enable both SSI and AIO. SSI ships disabled in all Centmin Mod vhost templates (# ssi on; is commented out), and Centmin Mod's default nginx.conf doesn't enable aio. Default installs are not affected.
• Credit: cyberlancer.

Notable Non-Security Changes in Nginx 1.31.7

These ship in mainline 1.31.7 only. Stable 1.30.6 also includes the five security fixes, plus backported bugfixes listed in its changelog.

HTTP/2 Prioritization Switched to RFC 9218

The ngx_http_v2_module now uses the RFC 9218 "Extensible Prioritization" scheme, and ignores the older RFC 7540 priority signals. This changes the order in which nginx sends responses on a busy HTTP/2 connection; it doesn't need any configuration change.

This change also removed nginx's internal HTTP/2 priority tree, which third-party modules could in theory reference. Centmin Mod's default set of dynamic and static modules compiles and runs cleanly against 1.31.7 (see testing below).

Other Features

• MaxMind DB (MMDB) support in the built-in GeoIP modules: ngx_http_geoip_module and ngx_stream_geoip_module can now read MaxMind DB (GeoIP2/GeoLite2 .mmdb) databases. Centmin Mod compiles both modules by default (NGINX_GEOIP='y' and NGINX_STREAMGEOIP='y'). However, nginx enables MMDB support only when its build finds the libmaxminddb library, and a default Centmin Mod install doesn't have it, so default builds don't pick this up yet (the AlmaLinux 9 and 10 test builds reported it as not found). Centmin Mod does build libmaxminddb from source into /usr/local/nginx-dep when the GeoIP2 or ModSecurity options are enabled; whether nginx's build detects that copy hasn't been tested. The existing NGINX_GEOIPTWOLITE='y' option (ngx_http_geoip2_module) remains the supported way to use GeoIP2 databases for now.
• Backend SSL certificate verification by IP address: proxy_ssl_verify and related directives can now verify backend certificates issued for an IP address (iPAddress subjectAltName), not just a hostname.
• QUIC with quic_bpf: nginx can now be reconfigured and binary-upgraded when the quic_bpf directive is in use.

Bugfixes

• Cached X-Accel-Redirect: a worker could crash, or request count is zero alerts could appear in logs, when a cached response containing an X-Accel-Redirect header was served to a client. This is relevant to PHP apps that use X-Accel-Redirect for protected downloads together with FastCGI or proxy caching. The fix is also in 1.30.6.
• WebDAV COPY/MOVE with alias: a worker crash when ngx_http_dav_module handled COPY or MOVE in a location using alias (only relevant if you enabled NGINX_WEBDAV='y'). The fix is also in 1.30.6.
• QUIC "quic flood detected": QUIC connections could be closed when http3_stream_buffer_size was set to a small value. This bug appeared in 1.27.5.
• SSL connections closed without close_notify (log change): a connection closed or reset without a TLS close_notify alert is no longer treated as a clean shutdown. You may now see SSL_read() failed errors in your Nginx error logs for such connections. This is expected logging, not a new problem.
• Spurious [crit] SSL_write() failed: these messages no longer appear when the error actually happened while reading from the SSL connection.