NGINX has released updates for its mainline (1.31.7) and stable (1.30.6) branches, addressing five medium-severity security vulnerabilities, two of which date back to 2009. The updates are essential as they could impact a significant number of the websites powered by NGINX, which accounts for about 33.8% of all websites. The mainline version introduces new features such as MaxMind MMDB GeoIP support and QUIC hot-reload, while the stable branch focuses solely on security fixes. Users are strongly advised to upgrade from any version prior to 1.30.x or 1.31.x to avoid exposure to these vulnerabilities

NGINX 1.31.7 and 1.30.6 Patch Five Security Flaws, Two Back to 2009

NGINX released paired updates to both its mainline (1.31.7) and stable (1.30.6) branches today, fixing five medium-severity vulnerabilities rated by parent company F5. Two of those flaws—CVE-2026-15176 and CVE-2026-97205—stretch all the way back to 2009, leaving a large share of the roughly one-third of websites run on nginx potentially exposed. The mainline drop adds features like MaxMind MMDB GeoIP support, QUIC hot-reload and binary upgrade, and IP-based backend SSL verification, while stable stays fixes-only. Operators are urged to upgrade immediately regardless of branch, and to abandon the end-of-life 1.29.x and 1.28.x lines.

NGINX 1.31.7 and 1.30.6 Patch Five Security Flaws, Two Back to 2009 @ Linux Compatible