Upgrade to nginx 1.30.6 or 1.31.7 either way, but patch first where the vulnerable features are in use: HTTP/3 listeners (CVE-2026-95101), TLS session tickets with key rotation via ssl_session_ticket_key (CVE-2026-97629), ssi on together with aio (CVE-2026-97205), alias combined with rewrite in the same location (CVE-2026-15176), and 1.30.0+ / 1.31.2+ builds that evaluate variables in string expressions (CVE-2026-93479). Run `nginx -V` for the build and modules and `nginx -T` to dump the effective config, then grep for those directives. If you run njs and validate signed XML, update to njs 1.0.2 too.