NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks

NGINX released versions 1.30.6 and 1.31.7 on October 14 to address five vulnerabilities. Three of the flaws are memory bugs that could crash worker processes or potentially allow remote code execution, each requiring specific configurations to exploit. A fourth vulnerability allows an attacker to forge a TLS session, potentially bypassing client certificate checks. One of the vulnerabilities has been present in every NGINX release since May 2005. F5, the company behind NGINX, disclosed these issues. The fixes are critical for organizations relying on NGINX for web serving, proxying, or TLS termination.