Orgs urged to update NGINX to fix critical RCE and TLS session forgery flaws in F5's Oct 14 patch
F5 released NGINX versions 1.30.6 and 1.31.7 on October 14 to address five vulnerabilities, including critical memory bugs and a TLS session forgery issue.
Key points
- Updates fix five flaws, with three rated critical by F5 for potential remote code execution.
- A TLS vulnerability allows forged sessions that may bypass client certificate checks.
- Exploitation requires specific configurations such as shared session caches or HTTP/3.
NGINX versions 1.30.6 and 1.31.7, released by F5 on October 14, resolve five security vulnerabilities. One of these flaws has existed in every release since May 2005. The update addresses three memory corruption bugs, a TLS session forgery issue, and an HTTP/3 request smuggling flaw. F5 rates the three memory bugs as critical, while NGINX rates all five issues as medium severity.
How it unfolded
- F5 published NGINX versions 1.30.6 and 1.31.7 on October 14 to patch five identified vulnerabilities.
- The release addresses memory bugs present in the software since May 2005, alongside newer TLS and HTTP/3 flaws.
- As of October 15, none of the five vulnerabilities appeared in CISA's Known Exploited Vulnerabilities catalog.
Who is affected
Systems running NGINX versions prior to 1.30.6 or 1.31.7 are affected, but only if specific directives are configured. The three memory bugs require a location with an alias, a rewrite changing the URI, and usage of $request_filename. The TLS flaw affects systems using a shared session cache, a setting recommended in NGINX documentation. The HTTP/3 issue impacts default configurations that allow extra bytes in requests.
Our take on the response
F5 scored the three memory bugs at 9.2 on CVSS v4.0, labeling them critical, while the TLS flaw received an 8.3 score. NGINX, however, rates all five vulnerabilities as medium. This discrepancy highlights differing risk assessments between the vendor and the project maintainers. No attacks have been reported by either NGINX or F5, and the flaws are not yet in CISA's catalog.
Who needs to act first
Managed service providers should prioritize updating external-facing web servers and load balancers that use shared TLS session caches or HTTP/3. Teams usually begin by identifying systems with the specific directives mentioned in the advisories, such as alias rewrites or shared SSL caches. It is advisable to test the update in a staging environment before rolling it out to production to ensure configuration compatibility. Backing up current configurations is a standard precaution before applying any patch.
What to do and how to stay safe: NGINX
- Audit NGINX configurations for the use of shared session caches, alias directives with rewrites, and HTTP/3 enablement.
- Verify that your current NGINX version is lower than 1.30.6 or 1.31.7 to confirm exposure.
- Monitor logs for unusual worker process crashes or unexpected TLS session resumptions while planning updates.
- Once the vendor provides an update, apply the patch to affected systems and verify that services restart correctly.
Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time
General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Are these vulnerabilities being actively exploited in the wild?
No, neither NGINX nor F5 has reported any attacks, and none of the five flaws are in CISA's Known Exploited Vulnerabilities catalog as of October 15.
Which NGINX versions fix these five vulnerabilities?
Versions 1.30.6 and 1.31.7, released on October 14, address all five identified security issues.
Do all NGINX installations need to be updated immediately?
Only installations using specific configurations like shared session caches, alias rewrites, or HTTP/3 are affected; default setups without these directives are not vulnerable.
