thehackernews.com
Oct 16, 2026
NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks
AI-summarised brief · reviewed before publication
NGINX released versions 1.30.6 and 1.31.7 on October 14 to address five vulnerabilities, including a long‑standing memory bug and a TLS flaw that could bypass client‑certificate checks. The memory bugs could crash worker processes or enable code execution under specific configurations. The TLS issue involved uninitialized session‑ticket keys, potentially allowing forged sessions. An HTTP/3 flaw let clients inject extra bytes into requests. All five issues required particular directives to be exploitable, and NGINX rated them medium severity.
💡 Why It Matters
- · The TLS flaw threatens secure client authentication, a cornerstone of HTTPS.
- · The HTTP/3 bug exposes a new vector for manipulating request payloads, impacting the growing adoption of QUIC.
