NGINX Patches Five Flaws, Including Memory Bugs That Could Allow Code Execution and a TLS Weakness

NGINX released versions 1.30.6 and 1.31.7 on October 14 to fix five vulnerabilities, one of which has been present in every release since May 2005. Three are memory bugs that F5, the company behind NGINX, says could crash a worker process or possibly let an attacker run code. A fourth lets an attacker forge a TLS session that could get past client-certificate checks, though F5 describes the forgery as non-deterministic and beyond the attacker's control. The fifth lets an HTTP/3 client slip extra bytes into a request that NGINX passes on to a backend.

None of the five was in CISA's Known Exploited Vulnerabilities catalog as of October 15, and neither NGINX nor F5 reports attacks. NGINX rates all five medium, while F5 scores the three memory bugs 9.2 (Critical) on CVSS v4.0, the TLS flaw 8.3 and the HTTP/3 flaw 6.9.

Every flaw needs a specific setting to be exposed: an alias with a rewrite, a regex map, AIO with SSI, a shared TLS session cache, or HTTP/3. The shared session cache is recommended in NGINX's own documentation, and the other condition for the HTTP/3 flaw is on by default. The TLS bug sits in the automatic rotation of session ticket keys, where one of three key slots was left uninitialised, so a forged ticket could be accepted. Administrators should check their configuration against NGINX's advisories page for version ranges and workarounds.