nginx vulnerabilities in 2026: fixed versions and how to upgrade

Summary

nginx 1.30.6 (stable) and 1.31.7 (mainline) were released on 14 October 2026. They close five vulnerabilities, including CVE-2026-15176, CVE-2026-97205 and CVE-2026-93479. The upgrade is routine and needs no downtime.

What is fixed where

Severities and version numbers come from the official advisory list on nginx.org (checked 27 October 2026). Note that several news reports described the October batch as "critical, CVSS 9.2", while the vendor itself rates these as medium. The highest vendor severities in the set are CVE-2026-42533 and CVE-2026-42530, both marked major.

Vulnerability	Where	Vendor severity	Fixed in
CVE-2026-42533	map with regular expressions	major	1.31.3+ / 1.30.4+
CVE-2026-42530	HTTP/3, use-after-free	major	1.31.2+
CVE-2026-15176	alias combined with rewrite	medium	1.31.7+ / 1.30.6+
CVE-2026-93479	script evaluation	medium	1.31.7+ / 1.30.6+
CVE-2026-97205	asynchronous I/O	medium	1.31.7+ / 1.30.6+
CVE-2026-90439	ngx_http_v3_module	medium	1.31.6+ / 1.30.5+
CVE-2026-60005	ngx_http_slice_module	medium	1.31.3+ / 1.30.4+
CVE-2026-42945	ngx_http_rewrite_module	medium	1.31.0+ / 1.30.1+

The "Fixed in" column gives the first patched release on each branch, stable and mainline. If your build is older, every vulnerability fixed after it applies to you.

Checking your version

nginx -v
nginx -V 2>&1 | tr ' ' '\n' | grep -E '^--with-http_(v3|slice)_module'

If HTTP/3 is built in, CVE-2026-90439 affects you directly. The slice module is used to serve large files in chunks; if it is present, CVE-2026-60005 is relevant.

Updating

sudo apt update && sudo apt install --only-upgrade nginx   # Ubuntu, Debian
sudo dnf update nginx                                      # AlmaLinux, Rocky, RHEL
nginx -t && sudo systemctl reload nginx

Checking the configuration before the reload is required: if the config has an error, reload leaves the old version running and you may think you have updated.

If nginx was built manually

Rebuild it with the same options. You can look them up like this:

nginx -V 2>&1 | sed 's/ --/\n--/g'

Then upgrade the executable without dropping connections: send the USR2 signal to the master process, then QUIT to the old one. The nginx documentation describes this technique as upgrading the executable on the fly.

Verifying the result

nginx -v
ps -eo lstart,cmd | grep 'nginx: worker' | head -3

The version should be the new one, and the worker processes should have recent start times.

Frequently asked questions

Does running nginx behind Cloudflare protect me from these vulnerabilities?

Partially. The filtering service blocks some mass scanning, but requests still reach your server. You still need to update.

Should I use the stable or the mainline nginx branch on production servers?

For production sites, use the stable branch (1.30.x), which receives only fixes. The mainline branch also gets new features.

How do I find the nginx version of a site without logging in to the server?

curl -sI https://your-site/ | grep -i server

If the version is hidden with the server_tokens off directive, you cannot see it from outside, and that is the correct setting.