NGINX Patches 5 Flaws, Including a 20-Year-Old Bug

Michael Miller · 2026-10-15

If you run NGINX, you'll want to pay attention to this one. On October 14, the team behind the popular web server released versions 1.30.6 and 1.31.7 to fix five vulnerabilities. One of them has been sitting quietly in every release since May 2005. Yes, you read that right — nearly two decades. ### What Exactly Got Fixed? F5, the company that now owns NGINX, says three of the flaws are memory bugs. In plain English, that means they could crash a worker process — or, in the worst case, let an attacker run their own code on your server. The catch? Each one needs a specific configuration to actually be exploitable. So not every setup is at risk, but plenty are. Here's the quick breakdown: - Three memory-related bugs that can crash a worker or potentially allow remote code execution (RCE) - A fourth flaw that lets an attacker forge a TLS session - A fifth issue tied to client-certificate checks that may get skipped entirely That last one deserves a closer look. If your setup relies on client certificates to verify who's connecting, a skipped check is a serious problem. It's like a bouncer who forgets to actually look at IDs. ### Why the TLS Bug Matters The TLS flaw is the kind of thing that keeps sysadmins up at night. An attacker could potentially forge a session and slip past checks that were supposed to stop them. If you're using mutual TLS (mTLS) for internal services or APIs, this isn't something to shrug off. > "A skipped client-cert check is a silent failure. You think you're protected, but you're not." That's the tricky part with security bugs like these. They don't always announce themselves. Everything looks fine on the surface until it isn't. ### What Should You Do Right Now? First, check which version you're running. If you're on anything older than 1.30.6 or 1.31.7, it's time to update. The upgrade itself is straightforward — no major config changes required for most users. Second, review your NGINX configuration. Specifically, look at anything involving TLS client verification and memory-heavy modules. If you're not sure whether your setup is affected, the safest move is to patch first and ask questions later. Third, if you can't update immediately, consider tightening access controls around affected endpoints. It's not a perfect fix, but it buys you time. ### The Bigger Picture A 20-year-old bug surviving this long is a good reminder that software ages in ways we don't always notice. Code written in 2005 is still running in production today, often in places nobody's looking. Regular patching isn't glamorous, but it's the difference between a quiet Tuesday and a very loud incident report. So do yourself a favor. Check your version, apply the update, and sleep a little easier tonight.