---
title: Tip: triage the Oct 2026 nginx fixes by the features you actually enable | ctxsec
url: https://ctxsec.com/items/tip-nginx-oct-2026-triage
description: ""
status: "tip"
published: 2026-10-14
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-nginx-oct-2026-triage.md)

tip

2026-10-14

### Tip: triage the Oct 2026 nginx fixes by the features you actually enable

Upgrade to nginx 1.30.6 or 1.31.7 either way, but patch first where the vulnerable features are in use: HTTP/3 listeners (CVE-2026-95101), TLS session tickets with key rotation via ssl_session_ticket_key (CVE-2026-97629), ssi on together with aio (CVE-2026-97205), alias combined with rewrite in the same location (CVE-2026-15176), and 1.30.0+ / 1.31.2+ builds that evaluate variables in string expressions (CVE-2026-93479). Run `nginx -V` for the build and modules and `nginx -T` to dump the effective config, then grep for those directives. If you run njs and validate signed XML, update to njs 1.0.2 too.

Sources: [nginx security advisories](https://nginx.org/en/security_advisories.html) · [nginx news](https://nginx.org/)