NGINX patches five flaws in 1.30.6/1.31.7: three memory bugs with possible RCE, a TLS client-cert bypass and HTTP/3 smuggling
NGINX released versions 1.30.6 (stable) and 1.31.7 (mainline) on October 14 to fix five vulnerabilities, one of which has been present in every release since May 2005. Three are memory-corruption bugs that F5 says could crash a worker process or possibly allow code execution. A fourth is a TLS session-ticket flaw that may let a forged ses…