TechAtelier

CYBERSECURITY · OCTOBER 27, 2026

Nginx: five vulnerabilities fixed — how to check your server

Ubuntu's USN-8955-1 notice, issued October 26, 2026, fixes five Nginx vulnerabilities. Exposure depends on configuration, so verify the package and enabled features before changing production.

Five vulnerabilities with different prerequisites

Ubuntu advisory USN-8955-1 lists CVE-2026-15176 (alias combined with rewrite), CVE-2026-93479 (regex-based map directives), CVE-2026-95101 (HTTP/3 with proxy_request_buffering), CVE-2026-97205 (asynchronous file I/O with SSI), and CVE-2026-97629 (SSL session tickets with shared cache and no explicit key rotation). Depending on the issue and server configuration, potential impacts include denial of service, arbitrary code execution, data injection into proxied requests or bypass of client certificate verification.

Which deployments are affected?

Ubuntu states the HTTP/3 issue affects only 26.04 LTS and 26.10; the SSL ticket issue affects 24.04 LTS, 26.04 LTS and 26.10. A module compiled into Nginx does not establish that the relevant feature is configured or active.

Ubuntu patched package versions

  • Ubuntu 26.04 LTS: 1.28.3-2ubuntu1.12
  • Ubuntu 24.04 LTS: 1.24.0-2ubuntu7.19
  • Ubuntu 22.04 LTS: 1.18.0-6ubuntu14.22

These are Ubuntu package revisions, not universal upstream version requirements. For other repositories, containers or source builds, check the appropriate vendor advisory.

Safe checks before applying updates

  1. Inspect the complete package version with dpkg-query -W nginx nginx-common and apt-cache policy nginx.
  2. Check build options with nginx -V and inspect loaded configuration using sudo nginx -T; its output may contain sensitive data, so do not publish it verbatim.
  3. Compare active settings with the advisory conditions: alias, rewrite, map, quic, proxy_request_buffering, aio, ssi and TLS session settings.
  4. For affected systems, plan a maintenance window, validate syntax with sudo nginx -t and check critical HTTPS endpoints after the vendor-supported update.

Why the upstream version string is not enough

nginx -v reports the upstream version, not the full Ubuntu package revision. Distributions may backport fixes, so compare the installed package revision with the published fix and ensure the running service uses that package.

TechAtelier recommendation

Don't change configuration directives at random. Patch through the right distribution channel, validate syntax, test critical routes and retain a recovery path. Verification after maintenance matters as much as a successful package installation.

Sources

Ubuntu — USN-8955-1, October 26, 2026 · Nginx — official security advisories.