high CVSS 8.5 EPSS 0.18%

CVE-2026-97629·Nginx vulnerability

Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-deterministic manner that is beyond the attacker's control. An attacker could leverage this vulnerability to bypass verification of client certificates. Impact This vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Severity
high
Software
Nginx
Fixed in
1.30.4-8
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.18% — higher than 7% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Read the two together. CVE-2026-97629 scores 8.5 on CVSS, so a successful attack would be serious — but at 0.18%, almost nobody is currently attempting it. That is a different situation from a flaw under mass exploitation, and it is usually the difference between patching on your next maintenance window and patching tonight.

Affected versions

Until: 1.30.4-8

Fixed in: 1.30.4-8

How to fix this CVE

Upgrade Nginx to version 1.30.4-8 or later to address the SSL session ticket key rotation vulnerability. This fix ensures that SSL session ticket keys are properly rotated when using shared session caching, preventing attackers from forging client SSL sessions and bypassing certificate verification. Apply this update across all Nginx instances in your infrastructure to eliminate the attack surface.

sudo dnf update nginx

Defensia detects this vulnerability

How to check if you are affected

  1. Step 1: Check installed Nginx version by running: nginx -v
  2. Step 2: Verify ssl_session_cache configuration in nginx.conf with: grep -r 'ssl_session_cache' /etc/nginx/
  3. Step 3: Confirm whether ssl_session_ticket_key directives are present: grep -r 'ssl_session_ticket_key' /etc/nginx/ (absence indicates vulnerability)
  4. Step 4: After patching, re-run nginx -v to confirm upgrade to version 1.30.4-8 or later

FAQ

What is CVE-2026-97629?

CVE-2026-97629 is a vulnerability in Nginx that affects SSL session ticket key management. When shared session caching is configured without explicit ticket key rotation directives, attackers can forge SSL client sessions and bypass client certificate verification, potentially gaining unauthorized access to protected resources.

Is CVE-2026-97629 being actively exploited?

No, CVE-2026-97629 is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog and no public exploits are currently available. However, this does not mean exploitation cannot occur—prompt patching remains essential.

What versions of Nginx are affected by CVE-2026-97629?

All Nginx versions prior to 1.30.4-8 are affected. This includes both Nginx Open Source and Nginx Plus installations. The vulnerability has no known lower bound version limit documented in public advisories.

How do I check if my server is vulnerable to CVE-2026-97629?

Run 'nginx -v' to check your version—if it is earlier than 1.30.4-8, you are vulnerable. Additionally, check if ssl_session_cache is configured with 'grep -r ssl_session_cache /etc/nginx/' and verify the absence of ssl_session_ticket_key directives.

Does Defensia detect CVE-2026-97629?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If Nginx is installed on a monitored server, CVE-2026-97629 will appear in your dashboard with remediation steps.

Related Nginx CVEs

CVE-2009-3555CVSS 10The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
CVE-2021-23017CVSS 9A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact.
CVE-2023-44487CVSS 9The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2026-42946CVSS 9A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data. When scgi_pass or uwsgi_pass is configured, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to read the memory of the NGINX worker process or restart it.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2026-60005CVSS 9NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX worker process, leading to limited disclosure of memory or a restart. Impact: This vulnerability may allow remote, unauthenticated attackers to have limited control to disclose memory contents or restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only. Note: The ngx_http_slice_module module is not enabled by default; it's enabled with the --with-http_slice_module configuration parameter. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-97629. Free for 1 server.

Get started free