On this page (7 sections)
On 26 October 2026 Ubuntu published USN-8955-1, fixing several nginx vulnerabilities. Two of them are heap buffer overflows rated critical (CVSS 9.2) that can crash an nginx worker and, under some conditions, may allow code execution. A third allows data injection into proxied requests over HTTP/3.
If you run nginx on Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS or 26.10, or manage servers that do, you should update. The critical flaws only apply to certain configurations, so it is also worth checking whether yours is one of them.
What was fixed
The Ubuntu notice covers five issues. Details for the first three come from the GitHub Advisory Database entries, which mirror NVD records and point to F5 articles. The last two are described only in the Ubuntu notice, so we can report less about them.
| CVE | Trigger | Impact | Score |
|---|---|---|---|
| CVE-2026-15176 | alias with rewrite, plus set or return using $request_filename (or $request_filename in an access log format) | Heap buffer overflow, worker restart, possible code execution | 9.2 Critical |
| CVE-2026-93479 | map with regex matching, with root or log format using the regex capture variables before the map output variable (or certain non-cacheable variables in string expressions) | Heap buffer overflow, worker restart, possible code execution | 9.2 Critical |
| CVE-2026-95101 | HTTP/3 (ngx_http_v3_module) with proxy_request_buffering on | Data injected into the proxied request | 6.9 Medium |
| CVE-2026-97205 | Asynchronous file I/O with Server Side Includes pages | Crash (denial of service) or possibly code execution, per Ubuntu | Not in our research |
| CVE-2026-97629 | Shared session cache without explicit ticket key rotation | Forged client SSL sessions, bypass of client certificate verification, per Ubuntu | Not in our research |
Technical details
Both critical issues are classified as CWE-122, a heap-based buffer overflow. In plain terms, nginx writes more data into a memory buffer than it was sized for, which corrupts neighboring memory. The usual result is that the worker process crashes and nginx restarts it, which is a denial of service if an attacker can repeat it.
The advisories also say attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled, or when the attacker can bypass ASLR. They describe the attacker as unauthenticated and sending crafted HTTP requests, and mention conditions beyond the attacker's control. The CVSS v4 vectors rate attack complexity as High for both critical flaws, which fits that wording. The advisories state there is no control plane exposure; this is a data plane issue only.
The HTTP/3 flaw (CWE-172) is different. With proxy_request_buffering enabled on an HTTP/3 listener, an unauthenticated attacker may be able to inject data into the request nginx forwards to your backend. Its vector shows low integrity impact and no confidentiality or availability impact. Ubuntu says this issue affected only Ubuntu 26.04 LTS and 26.10.
For the session ticket issue, Ubuntu says it affected only Ubuntu 24.04 LTS, 26.04 LTS and 26.10. The advisories note that software versions past End of Technical Support are not evaluated, so an old unsupported nginx may be vulnerable without being listed.
Who is realistically exposed
The two critical flaws need particular configuration patterns, so a default nginx install is not automatically affected. Sites most likely to match are those with URL rewriting in alias locations (static file mappings, legacy path redirects), regex-based map blocks feeding root or log formats, or custom access log formats that reference $request_filename. Hosting providers and agencies with many hand-edited server blocks should assume some of them match.
Internet-facing servers matter most, since the attacker needs only to send HTTP requests. Servers behind a CDN or load balancer are still reachable if crafted requests are passed through. We found no report of active exploitation in the sources reviewed, but the patch is available, so there is little reason to wait.
How to check your exposure
First, find the installed version. This is read-only and works on any distribution; compare the result with the fixed Ubuntu versions above.
nginx -vOn Ubuntu, the package version tells you whether the fix is installed. Look for the version listed for your release in the facts block, or higher.
dpkg -l | grep nginxNext, search the full loaded configuration for the directives named in the advisories. This prints matching lines with line numbers and changes nothing. Any hit means that part of the config deserves a closer look; a hit alone does not prove you are vulnerable, because the flaw needs the specific combinations described above.
sudo nginx -T 2>/dev/null | grep -nE 'alias|request_filename|map .*~|proxy_request_buffering|quic|http3|ssl_session_cache|ssl_session_ticket_key'What to do now
The fix is a normal package update. Reloading or restarting nginx is required for the new binary to take over, so schedule it sensibly.
sudo apt update && sudo apt install --only-upgrade nginx nginx-core nginx-full nginx-light nginx-extrasIf only some of those packages are installed, apt may report the others as not installed; install-only-upgrade will update what you have. Then validate the configuration and restart the service.
sudo nginx -t && sudo systemctl restart nginx && systemctl status nginx --no-pager0 of 7 done
Detection and monitoring
A crash in a worker process is the visible symptom of the overflow flaws. Review the error log for worker processes exiting on a signal and for repeated respawns, especially if they line up with odd requests in the access log. This is read-only.
sudo grep -iE 'signal|exited on|worker process' /var/log/nginx/error.log | tail -n 50Repeated worker exits that you cannot explain are a reason to patch immediately and investigate the matching requests. A single historic entry is not proof of attack.
After patching, keep an eye on the outside view of your server. A certificate and header monitoring service can alert you to unexpected changes, and the free security headers checker and SSL checker help confirm your public configuration still looks as intended after a restart. For background on filtering malicious requests in front of a server, see what is a WAF.
Timeline
- 14 October 2026: the three CVE records for CVE-2026-15176, CVE-2026-93479 and CVE-2026-95101 appear in the GitHub Advisory Database, sourced from NVD
- 26 October 2026: Ubuntu publishes USN-8955-1 with fixed packages for 22.04 LTS, 24.04 LTS, 26.04 LTS and 26.10
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.