nginx.org released nginx 1.30.6 (stable) and 1.31.7 (mainline) on Oct 14 with fixes for: a buffer overflow with alias plus rewrite (CVE-2026-15176, vulnerable 0.1.29 to 1.31.6), a buffer overflow in string-expression evaluation with variables (CVE-2026-93479, 1.31.2 to 1.31.6 and 1.30.0 to 1.30.5), HTTP/3 request body injection (CVE-2026-95101, 1.25.0+), session forgery with TLS session ticket key rotation (CVE-2026-97629, 1.23.2+), and a use-after-free with ngx_http_ssi_module plus AIO (CVE-2026-97205, 0.8.11+). nginx rates all five medium; F5 has matching advisories for NGINX Plus. njs 1.0.2 fixes memory exhaustion on malformed XML (CVE-2026-101025) and inconsistent XML attribute values affecting signed XML validation (CVE-2026-101019). No exploitation reported.