NGINX has shipped versions 1.30.6 and 1.31.7 to address five security vulnerabilities. The updates arrived October 14 and include fixes for three memory-related bugs that, according to F5, could crash a worker process or possibly allow an attacker to execute arbitrary code.
Among the patches is a TLS issue that may cause client-certificate checks to be skipped. The disclosure also notes that one of the flaws has been present in every NGINX release since May 2005, meaning the issue has persisted across roughly two decades of updates.
Users should upgrade to the patched versions to mitigate the risk. Because the RCE potential is described as possible rather than confirmed, the immediate priority is applying the fix before exploitation attempts target the affected releases.