nginx-1.31.7

{
  "id": "25e4a865eee45d762b264f0504edf0fce3bc8a256819ef56e003a8214b0246c0",
  "url": "https://github.com/nginx/nginx/releases/tag/release-1.31.7",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "nginx-1.31.7",
    "summary": "nginx-1.31.7 fixes multiple vulnerabilities involving buffer overflows, HTTP/3 request body injection, TLS session forgery, and use-after-free.",
    "evidence": "nginx-1.31.7 mainline version has been released, with fixes for buffer overflow vulnerability when using alias with rewrite (CVE-2026-15176), buffer overflow vulnerability when evaluating string expressions with variables (CVE-2026-93479), request body injection vulnerability in HTTP/3 (CVE-2026-95101), session forgery vulnerability when using TLS session ticket key rotation (CVE-2026-97629), and use-after-free vulnerability when using ngx_http_ssi_module with AIO (CVE-2026-97205).",
    "products": [
      {
        "name": {
          "value": "nginx",
          "evidence": "nginx-1.31.7 mainline version has been released"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "nginx-1.31.7",
            "evidence": "nginx-1.31.7 mainline version has been released"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2026-15176",
        "evidence": "buffer overflow vulnerability when using alias with rewrite (CVE-2026-15176)"
      },
      {
        "value": "CVE-2026-93479",
        "evidence": "buffer overflow vulnerability when evaluating string expressions with variables (CVE-2026-93479)"
      },
      {
        "value": "CVE-2026-95101",
        "evidence": "request body injection vulnerability in HTTP/3 (CVE-2026-95101)"
      },
      {
        "value": "CVE-2026-97629",
        "evidence": "session forgery vulnerability when using TLS session ticket key rotation (CVE-2026-97629)"
      },
      {
        "value": "CVE-2026-97205",
        "evidence": "use-after-free vulnerability when using ngx_http_ssi_module with AIO (CVE-2026-97205)"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "github-nginx-nginx",
  "document_id": 21866,
  "published_at": "2026-10-15T00:45:57+00:00"
}