nginx DSA-6575-1 (October 2026): five memory, HTTP/3 and TLS session ticket fixes for Debian 13

On 21 October 2026 Debian published DSA-6575-1 for nginx in Debian 13 (trixie), fixing five vulnerabilities that nginx disclosed together. Debian says that, depending on the configuration, they "could result in memory corruption, denial of service, injection of requests to backend servers, or bypass of client certificate authentication". nginx rates all five as medium. For Debian 12 (bookworm), no LTS advisory had been published as of 31 October 2026.

At a glance

What the vulnerabilities are

Each issue depends on specific features being in use, which helps you judge your own exposure:

• CVE-2026-15176, alias with rewrite. Mapping a rewritten URI to a file path in a location that uses alias could overflow a buffer.
• CVE-2026-93479, string expression evaluation. Evaluating expressions such as variable document roots or access log paths could overflow a buffer. Debian notes that in trixie this code arrived through an earlier security backport.
• CVE-2026-95101, HTTP/3. Fragmented unknown HTTP/3 frames could be treated as request body data. When proxying, this could allow requests to be injected into a backend or body size limits to be bypassed. nginx lists versions 1.25.0 and later as affected.
• CVE-2026-97205, asynchronous file I/O (aio). A counter of pending operations could overflow, freeing request memory while still in use, with possible memory corruption or denial of service.
• CVE-2026-97629, TLS session tickets. Worker processes could use uninitialised ticket key material, which could allow forged TLS sessions and bypass of client certificate authentication. Session tickets are on by default in nginx (ssl_session_tickets on).

F5, the CNA for nginx, gives CVE-2026-15176, CVE-2026-93479 and CVE-2026-97205 a CVSS 3.1 score of 8.1 with high attack complexity. None of the five is in the CISA Known Exploited Vulnerabilities catalog as of 30 October 2026.

Are you affected?

Check the installed version:

dpkg -l 'nginx*' 'libnginx-mod-*'
apt policy nginx nginx-common

On Debian 13, anything older than 1.26.3-3+deb13u10 is affected. To see which of the features above your configuration uses, dump the full configuration (the -T switch tests and prints it) and search it:

sudo nginx -T 2>/dev/null | grep -nE '^\s*(alias|aio|ssl_session_tickets)\b|quic'

On Debian 12, the nginx tracker page still showed all five CVEs as unfixed for bookworm on 31 October 2026, and nginx is listed in the LTS team's dla-needed.txt work queue. Watch debian-lts-announce for the DLA. Debian 11 (bullseye) is past the end of LTS and should be upgraded.

How to update

sudo apt update
sudo apt upgrade

Or limit the change to nginx. Add any libnginx-mod-* packages that dpkg -l showed, so that they are upgraded together with nginx:

sudo apt install --only-upgrade nginx nginx-common

Ubuntu ships different nginx builds; check Ubuntu Security Notices.

Restart or reboot?

No reboot is needed. Test the configuration and restart nginx so every worker runs the new binary:

sudo nginx -t
sudo systemctl restart nginx
sudo systemctl status nginx --no-pager

Sources

• security-tracker.debian.org/tracker/DSA-6575-1
• debian.org/security/2026/dsa-6575
• lists.debian.org/debian-security-announce/2026/msg00490.html
• nginx.org/en/security_advisories.html
• cve.org/CVERecord?id=CVE-2026-15176
• cve.org/CVERecord?id=CVE-2026-97629
• security-tracker.debian.org/tracker/CVE-2026-15176
• security-tracker.debian.org/tracker/nginx
• salsa.debian.org/security-tracker-team/security-tracker/-/raw/master/data/dla-needed.txt
• packages.debian.org/source/trixie/nginx
• nginx.org/en/docs/switches.html
• nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_tickets
• lists.debian.org/debian-lts-announce