NGINX fixes five vulnerabilities, including possible RCE and a TLS flaw

NGINX released versions 1.30.6 and 1.31.7 on October 14 to fix five vulnerabilities. Three memory bugs could crash a worker process or possibly allow code execution under specific configurations. A TLS flaw could allow a forged TLS session to bypass client-certificate checks, while an HTTP/3 flaw could allow extra bytes in a request to be passed to a backend. NGINX rates all five flaws medium severity. According to the source, none was in CISA’s Known Exploited Vulnerabilities catalog as of October 15, and neither NGINX nor F5 reported attacks.