nginx Vulnerability 2026: 15 October CVEs, Who Is Affected

A security reel went around this week with 15 CVE numbers across PHP, Next.js, Node.js, nginx, GitLab and Java, most of them stamped CRITICAL. I checked each ID against the vendor's own advisory on 25 October 2026. All 15 are real, the nginx vulnerability 2026 batch and the PHP pair included. None of the 15 is in CISA's Known Exploited Vulnerabilities catalog (version 2026.10.23), and CISA's own assessment lists exploitation as "none" for every ID except one, CVE-2026-96889, which has a "poc" mark.

"Black October" is not a named campaign. It is a cluster of ordinary advisories that landed close together: nginx and Next.js on 14 October, GitLab on 12 and 21-22 October, PHP, Node.js and an Oracle Java alert on 21 October. Three labels in the reel are misleading, and that changes who needs to hurry. Below: a summary table, then each product with a check and a fix.

Summary: who is affected and what to install#

The three misleading labels:

• CVE-2026-96889 is attributed to Next.js in the reel. The CVE itself is a use-after-free in librsvg (Red Hat CNA, CVSS v3.1 7.8). Next.js is affected because its image optimizer uses sharp, which bundles librsvg.
• CVE-2026-111497 is a Brotli decoder flaw (CNA Google, product Brotli). It reaches you through Node, which Node rates High, not Critical, and only if you decompress attacker-supplied Brotli.
• nginx "CRITICAL" is F5's CVSS v4 score. The nginx project itself rates all three "Medium".

nginx vulnerability 2026: three bugs, three configurations#

Fixed on 14 October in 1.30.6 (stable) and 1.31.7 (mainline). F5 scores them CVSS v4 9.2 and v3.1 8.1. Code execution requires ASLR to be off or bypassed, which is why nginx.org says Medium.

Am I affected? Only if your config contains the trigger. Check the version and grep the full config:

nginx -v
nginx -T 2>/dev/null | grep -nE 'alias|rewrite|request_filename|aio|ssi|map'

• CVE-2026-15176: buffer overflow when alias is combined with rewrite, plus set or return using $request_filename, or $request_filename inside log_format. Avoid that combination until you upgrade.
• CVE-2026-93479: buffer overflow in script evaluation, in a map with regex where root or log_format refer to the regex captures. Affects 1.30.0-1.30.5 and 1.31.2-1.31.6. Mitigation per the advisory: use named captures limited to the block.
• CVE-2026-97205: use-after-free with aio together with SSI include virtual. Switch off aio or SSI.

How to close it: upgrade to 1.30.6 or 1.31.7. The same release fixed CVE-2026-95101 (HTTP/3 request-body injection) and CVE-2026-97629 (TLS session-ticket forgery), so upgrading is worth it even if your config avoids all three triggers. Sources: nginx.org security advisories and F5 articles K000162416, K000162607, K000162608.

PHP vulnerability 2026: two RCEs fixed on 21 October#

Both advisories (GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp in php/php-src) carry CVSS v4 9.2. Fixed in 8.2.35, 8.3.36, 8.4.27 and 8.5.12.

CVE-2026-109618, "RCE via OOM corruption". Unauthenticated. A full RCE was validated over HTTP against Apache mod_php, during multipart body parsing, before your application code runs. FrankenPHP is likely susceptible. FPM is susceptible according to source analysis, but no full exploit was shown. Until you upgrade: keep post_max_size conservative, limit multipart parts, block multipart at the frontend if you don't use uploads, restart workers. Do not rely on RLIMIT_AS or RLIMIT_DATA, the advisory says they are not a fix.

CVE-2026-109619, "RCE via stale global state". Needs a producer request and a consumer request in the same worker. Confirmed on mod_php via fatal_error_backtraces (PHP 8.5), with a second path through session upload progress. Temporary measures: fatal_error_backtraces=0, session.upload_progress.enabled=0, remove per-request INI overrides such as PHP_VALUE, restart workers.

Check with php -v and php -i | grep -E 'post_max_size|upload_progress|fatal_error_backtraces'. Third-party reports of a public PoC exist, but PHP has not confirmed them.

Node.js: take 22.23.4, 24.22.1 or 26.12.1#

Released on 21 October, the Node.js security release. Node 20 reached end of life in April 2026 and gets no fixes, so on 20 the answer is a version change, not a patch.

The same release has medium fixes (CVE-2026-105481 keep-alive response smuggling, CVE-2026-106072, CVE-2026-106074), a certificate-store update that distrusts eMudhra intermediates, and updates of OpenSSL, c-ares, Undici and SQLite. To see whether this node js security update reached a container, node -v on your laptop proves nothing. Run docker run --rm <image> node -v, and rebuild: a node:22 image you pulled last month still contains the old Node.

GitLab vulnerability: a 10.0 score and no workaround#

• CVE-2026-110264: integer overflow in the regular expression compiler, CVSS v3.1 10.0, unauthenticated "under certain conditions". Fixed in 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3 and 19.5.1 (patch release of 22 October). No workaround.
• CVE-2026-97229: integer overflow in the CI/CD regex compiler, CVSS 10.0. An unauthenticated crafted regex in CI config. Fixed in 19.2.8, 19.3.5 and 19.4.2 on 12 October.

GitLab.com and Dedicated were patched by GitLab. If you run a self-managed instance, you are the one affected: find the version on the Help page or with gitlab-rake gitlab:env:info, and move to the patch release of your line. With no workaround, the only mitigation is to keep the instance off the open internet until you do.

Java: one alert about certificates, not code execution#

CVE-2026-91403 is an Oracle Security Alert from 21 October for Java SE and GraalVM, component JSSE, CVSS v3.1 9.1. According to the alert, the fix distrusts compromised eMudhra intermediate CA certificates. My reading of the practical risk is a TLS man-in-the-middle with a certificate chained to those intermediates, not remote code execution. That is my inference, not Oracle's wording.

Listed as affected: Java SE 8u511, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1, and GraalVM for JDK 17.0.21 and 21.0.13. I could not confirm the fixed build numbers, so take them from Oracle's Patch Availability Document. Run java -version and compare. Node shipped the same eMudhra change on the same day.

Next.js: three advisories, one article#

Three advisories cover Next.js: two unauthenticated RCEs (one in use cache functions, one in the Image Optimization API with SVG) and a Server Actions DoS. The fix is 16.4.1 or 15.5.28, and 16.4.3 is the latest. The conditions, the grep commands and what I found on my own servers are in the separate piece on the Next.js vulnerability of October 2026.

How to read a scary CVE list#

1. Check which score you see. The same bug can be 9.2 in CVSS v4, 8.1 in v3.1 and "Medium" in the vendor's own table. nginx is the example this month. Ask who assigned the number: the vendor, the CNA or an aggregator.
2. Read the precondition before the score. "Unauthenticated RCE" next to "needs aio plus SSI include virtual" or "needs ASLR off" is a different problem from an RCE on a default install.
3. Open CISA KEV. Being in the catalog means exploitation is confirmed. Absence is not safety, but it separates "patch this week" from "patch tonight".
4. Find the real component. CVE-2026-96889 sat under a Next.js label while living in librsvg. If you search your stack by product name, you miss it.
5. Count what you really run. A list of 15 shrinks quickly once you cross out products you don't have.

What my stack needed#

I run seven Next.js sites in Docker on one server through Dokploy, with Traefik in front. No nginx, PHP, Java or GitLab. Out of the 15, my share was Next.js, Node.js, sharp and the Docker base images. The audit result (6 of 7 sites vulnerable, the digest-pinned image that froze an old Node patch, the dangerouslyAllowSVG flag I never needed) is in the companion article.

If you self-host a wiki or similar tools next to your apps, the same rules apply to them; I wrote about one such setup in ClewWiki as a self-hosted team wiki.