At a glance
- Nginx has a session spoofing flaw involving TLS session tickets.
- CVE-2026-97629 affects Nginx 1.23.2–1.31.6.
- The severity is rated medium.
- Check the installed version and prioritize upgrading to 1.30.6+ or 1.31.7+.
Nginx: session spoofing flaw involving TLS session tickets and upgrade guidance
Nginx has a session spoofing flaw involving TLS session tickets, tracked as CVE-2026-97629 and rated medium. Versions 1.23.2–1.31.6 are affected; check installed versions and upgrade to 1.30.6+ or 1.31.7+.
In this article
Nginx Security published an advisory about a session spoofing flaw in Nginx when TLS session tickets are used, tracked as CVE-2026-97629. Check deployed versions and plan an upgrade using the guidance in the Nginx Security advisory.
Overview and technical details
Nginx is a web server and reverse proxy used to serve and forward web application traffic. The described flaw allows session spoofing when TLS session tickets are used; its severity is rated medium.
| Field | Details |
|---|---|
| Product | Nginx |
| CVE | CVE-2026-97629 |
| Severity | Medium |
| Source | Nginx Security |
Affected systems
| Product | Affected versions | Unaffected versions |
|---|---|---|
| Nginx | 1.23.2–1.31.6 | 1.30.6+ or 1.31.7+ |
Mechanism and impact
The flaw is associated with the use of TLS session tickets and allows session spoofing. The source does not describe additional triggering conditions or other impacts; do not extend the conclusion beyond this description.
System checks
- Check the installed Nginx version with the following commands:
nginx -v
nginx -VCompare the displayed version with the affected 1.23.2–1.31.6 range. Versions 1.30.6+ or 1.31.7+ are identified as unaffected.
Remediation and mitigation
- Prioritize upgrading Nginx during an early maintenance window to version 1.30.6+ or 1.31.7+.
This is the remediation action provided in the source. No workaround or post-upgrade verification step is provided.
Related articles
Nginx discloses CVE-2026-93479: check versions and upgrade affected branches
Nginx disclosed buffer overflow CVE-2026-93479 during script evaluation, rated medium severity. Nginx 1.31.2–1.31.6 and 1.30.0–1.30.5 are affected; check the installed version and upgrade to 1.31.7+ or 1.30.6+, respectively.
UnrealIRCd: CISA confirms active exploitation of CVE-2026-114713
CISA confirms CVE-2026-114713 in UnrealIRCd is being exploited in the wild. A user on a network with at least two linked servers can inject server-to-server commands executed with server privileges. Prioritize mitigations under CISA guidance before the KEV deadline of 2026-11-16.