NGINX Patches Five Vulnerabilities, Including Potential RCE and TLS Client-Cert Bypass

NGINX Releases Security Updates

NGINX has issued security updates with versions 1.30.6 and 1.31.7 on October 14, addressing five distinct vulnerabilities. These patches resolve issues that have been present in some NGINX releases since May 2005.

Details of the Vulnerabilities

The updates fix three memory-related bugs that F5, the company behind NGINX, states could cause a worker process to crash or potentially allow an attacker to execute code. Each of these memory bugs requires a specific NGINX configuration to be vulnerable. A fourth vulnerability involves a TLS flaw that could enable an attacker to forge a session and potentially bypass client-certificate checks, though F5 notes this forgery is non-deterministic. The fifth flaw allows an HTTP/3 client to insert extra bytes into a request that NGINX then forwards to a backend server.

Exploitation Conditions and Impact

All five vulnerabilities require specific NGINX directives to be active for exploitation, such as an alias with a rewrite, a regex map, AIO with SSI, a shared TLS session cache, or HTTP/3. The TLS flaw, for instance, is tied to the automatic rotation of session ticket keys when a shared session cache is configured, a setting recommended in NGINX's documentation. F5 has rated the three memory bugs as Critical (CVSS v4.0 score 9.2), the TLS flaw as 8.3, and the HTTP/3 flaw as 6.9. None of these vulnerabilities were listed in CISA's Known Exploited Vulnerabilities catalog as of October 15, and neither NGINX nor F5 has reported any active attacks.

TLS Flaw in Session Key Rotation

The TLS vulnerability stems from an issue in the automatic rotation of session ticket keys, a feature introduced in NGINX version 1.23.2. When a shared session cache is used, NGINX generates and rotates these keys. The flaw occurred because the rotation process only copied two of the three key slots, leaving the third slot with uninitialized memory. An attacker could then use a ticket referencing this uninitialized slot to verify and decrypt with the old, uninitialized key material, potentially allowing a forged session to bypass client certificate verification. NGINX previously fixed a similar session-reuse flaw, CVE-2025-23419, in February 2025.