NGINX releases patches for five security vulnerabilities

NGINX has released updates (versions 1.30.6 and 1.31.7) to address five security vulnerabilities. While the NGINX project has rated these flaws as ‘medium’ severity, F5, the company behind NGINX, has assigned a CVSS v4.0 score of 9.2 (Critical) to three of the memory-related bugs.

The vulnerabilities include three memory bugs that could potentially lead to a worker process crash or remote code execution, depending on specific configurations. A fourth flaw involves a non-deterministic TLS session forgery that could allow an attacker to bypass client-certificate checks. The fifth vulnerability affects HTTP/3 clients, allowing extra bytes to be passed to a backend.

Exploitation of these flaws requires specific directives, such as an alias with a rewrite, a regex map, AIO with SSI, a shared TLS session cache, or HTTP/3. As of mid-October, there have been no reports of these vulnerabilities being exploited in the wild.