NGINX security patch (Rift and 2026 CVEs)
In 2026 NGINX has shipped several batches of fixes: NGINX Rift (CVE-2026-42945) in May, CVE-2026-42533, with a public proof of concept, and five CVEs in October, including HTTP/3 request smuggling and a TLS session forgery that bypasses client certificate verification. To have all of them you need 1.31.7 or later (mainline) or 1.30.6 or later (stable).
Do you have this vulnerability? We update NGINX on your servers and containers, review the configuration that makes some of these flaws exploitable, and check that everything is still served the same way.
$ nginx -vnginx version: nginx/1.30.2# Stable < 1.30.6: missing the October fixes$ nginx -V 2>&1 | grep -o with-http_v3_modulewith-http_v3_module# HTTP/3 compiled in: check CVE-2026-95101$ grep -rnE 'request_filename|alias ' /etc/nginx//etc/nginx/sites-enabled/app.conf:14: alias /var/www/static/;# alias on a public path: CVE-2026-15176 pattern1.31.7+ (mainline) · 1.30.6+ (stable)Three batches of NGINX flaws so far in 2026
If you updated in May because of Rift, you are missing the later fixes. And if you use your distribution’s NGINX, the version number may look old even when the package carries the patches: the vendor’s security advisory is what counts.
NGINX Rift (CVE-2026-42945) was found in May by DepthFirst’s AI platform in about six hours, and the bug dated back to version 0.6.27, from 2008. It affects NGINX Open Source 0.6.27 through 1.30.0 and is fixed in 1.31.0 and 1.30.1. nginx.org rates it medium; Cloud Security Alliance and Help Net Security treat it as critical (9.2). According to Help Net Security, VulnCheck saw exploitation attempts from 16 May.
Then came CVE-2026-42533, fixed in 1.31.3 and 1.30.4, for which DepthFirst published a full-chain proof of concept. In October, another batch of five: CVE-2026-15176, CVE-2026-93479, CVE-2026-95101 (HTTP/3 request smuggling), CVE-2026-97629 (TLS session forgery that bypasses client certificate verification) and CVE-2026-97205, all fixed in 1.31.7 and 1.30.6.
Sources: nginx.org security advisories · Cloud Security Alliance · Help Net Security
Fixed NGINX versions
Compare your version with this table. It applies to NGINX Open Source from nginx.org or compiled yourself; for distribution packages, check the vendor’s advisory for each CVE.
| If you run | Update to | What you are missing |
|---|---|---|
| 1.31.3 – 1.31.6 | 1.31.7+ | The October batch |
| 1.31.0 – 1.31.2 | 1.31.7+ | CVE-2026-42533 and the October batch |
| 1.30.4 – 1.30.5 | 1.30.6+ | The October batch |
| 1.30.1 – 1.30.3 | 1.30.6+ | CVE-2026-42533 and the October batch |
| 0.6.27 – 1.30.0 | 1.30.6+ or 1.31.7+ | Rift and everything after it |
Check this
-
nginx -vreports a version older than 1.31.7 (mainline) or 1.30.6 (stable). - You have HTTP/3 enabled: the CVE-2026-95101 request smuggling applies to you.
- You require client certificates (
ssl_verify_client): CVE-2026-97629 lets an attacker bypass that check. - Your configuration uses
$request_filenameoralias(CVE-2026-15176), or regular expressions with unnamed captures (CVE-2026-93479). - NGINX runs inside Docker images or as a Kubernetes ingress: each image is updated separately.
Configuration changes while you update
nginx.org suggests configuration adjustments for some of the October flaws. They reduce exposure to those specific CVEs; for Rift and the rest, the fix is the update.
- 01 CVE-2026-15176: avoid
$request_filenameandaliasin exposedlocationblocks. - 02 CVE-2026-93479: use named captures, such as
(?<path>.+), instead of unnamed ones ($1,$2). - 03 Check in each
serverblock whether you actually use HTTP/3 and client certificates: those are the features hit by CVE-2026-95101 and CVE-2026-97629. - 04 Run
nginx -tbefore reloading. A syntax error in production takes down more services than the flaw you are fixing.
Seven steps, in this order
We follow the same procedure on every server: first find out which version runs where, then fix it, and finally check that nobody got in before the patch.
Version inventory
We list every NGINX: servers, load balancers, containers and ingress controllers, with their version, compiled modules (nginx -V) and where the package comes from: nginx.org, the distribution or a Docker image.
Immediate mitigation
We look for $request_filename, alias and unnamed captures in the configuration and change them where possible without altering what the site serves.
Update
We move to 1.31.7+ or 1.30.6+, or to your distribution’s patched package, and rebuild the images that include NGINX.
Verification
We run nginx -t, reload, and check redirects, certificates, HTTP/2 and HTTP/3 and the paths that serve static files.
Review for indicators of compromise
We go through access and error logs for unusual requests, back to May if the server was on a version affected by Rift.
Secret rotation, if needed
If there are signs of intrusion, we renew TLS certificates and private keys and the credentials that pass through the proxy.
Monitoring new advisories
We record each NGINX’s version and origin, so the next batch of nginx.org advisories starts from that inventory.
What a Rift-only patch leaves out
Running several NGINX instances and not sure which version each one has?
Free consultation →FAQ about the 2026 NGINX CVEs
What is NGINX Rift?
I already updated for Rift. Am I covered?
My distribution ships an older version. Am I affected?
Can I protect myself by changing only the configuration?
Tell us where your NGINX runs
We start with the inventory: version, package origin and modules of each NGINX, and which configuration needs changing before the update.
Tell us your challenge. We'll propose a solution.
No commitment. Within 24 hours, you'll receive a proposal with scope, timeline and budget. No fine print.