NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks

NGINX released versions 1.30.6 and 1.31.7 on October 14 to fix five vulnerabilities, one of them present in every release since May 2005. There are three memory bugs that F5, the company behind NGINX, says could crash a worker process or possibly let an attacker run code, and each requires a specific configuration to exploit. A fourth lets an attacker forge a TLS session that could

NGINX released versions 1.30.6 and 1.31.7 to address five vulnerabilities, including memory-safety flaws that may crash worker processes or potentially enable code execution, a TLS issue that may bypass client-certificate verification, and an HTTP/3 request-manipulation flaw.[2][3] The reported issues require specific configurations, and no exploitation was reported in the available coverage.[9] RealGround analysis: because NGINX may support AI applications and agent infrastructure, affected deployments represent an AI supply-chain and infrastructure-assurance concern; inventorying dependent components and applying the vendor fixes are practical mitigations.