NGINX Fixes 5 Vulnerabilities, Including Possible RCE and a TLS Bug

Summary: NGINX released versions 1.30.6 and 1.31.7 on October 14, fixing five vulnerabilities. One of these flaws had been present in every release since May 2005.

NGINX, a widely used web server and reverse proxy, has released updates to address five vulnerabilities. These include a critical remote code execution (RCE) flaw and a TLS bug that could bypass client-certificate checks.

These vulnerabilities stem from mechanisms such as a memory corruption issue in NGINX’s HTTP/2 module and improper handling of client certificate validation during the TLS handshake. The flaw present since 2005 indicates a long-standing, unnoticed vulnerability.

All infrastructure teams using NGINX in live systems must apply these updates urgently. The RCE vulnerability poses a severe security risk by allowing attackers to execute arbitrary code on the server, while the TLS bug could bypass authentication mechanisms.

This incident underscores the importance of patch management and security updates. For all systems using NGINX, especially those exposed to the internet, these updates should be prioritized, and systems may require a restart.

🔗 Source: The Hacker News
📡 Authoritative feeds & live tracking: Radar