nginx: check your version and keep it patched

Updated November 2026

To patch nginx, find out which package source it came from, update from that same source, run nginx -t, then restart it. As of November 3, 2026, the fixed upstream versions are stable 1.30.6 and mainline 1.31.8. Distribution packages carry the same fixes under older version numbers.

• 1.30.6Current stable (October 14, 2026)
• 1.31.8Current mainline (October 21, 2026)
• 5CVEs fixed in the October 14 security release

What nginx is

nginx is a web server, reverse proxy, load balancer and TLS terminator. It often sits in front of PHP-FPM, Node.js, Python or Java applications, and inside many Docker images and Kubernetes ingress setups. F5 maintains the open-source project and handles its security reports. Because nginx faces the internet directly, patch it before internal services. The general web-server routine is in patching web servers; this page covers nginx in more depth.

Check the installed version

nginx -v                                   # version only
nginx -V 2>&1 | head -n 3                  # version, OpenSSL, build details
ps -eo pid,lstart,cmd | grep '[n]ginx: master'   # when the running master started

nginx -V shows the OpenSSL version nginx was built with, and adds "running with OpenSSL …" if the loaded library differs. Next, find the package and its source. This decides which advisories apply to you:

apt policy nginx                 # Debian, Ubuntu: look at the repository line
rpm -qi nginx | grep -E '^(Version|Release|Vendor)'   # RHEL family, SUSE
dnf module list nginx            # RHEL 8 and 9: which stream is enabled
apk policy nginx                 # Alpine
pkg info nginx                   # FreeBSD
docker exec web nginx -v         # a container named "web"

Supported versions

nginx.org publishes two active lines. When a flaw affects both, the fix ships in both on the same day.

nginx.org gives no end-of-life dates. In practice a line stops getting fixes once it moves to the "Legacy versions" list. For example, the advisory for CVE-2026-15176 (buffer overflow when alias is used with rewrite) lists 0.1.29 to 1.31.6 as vulnerable and only 1.31.7+ and 1.30.6+ as fixed. Nobody upstream patches 1.28.

Distro packages or nginx.org

Distributions freeze one nginx version per release and backport fixes: they copy the security patch into their older version and add a suffix to the package version. So a distro nginx 1.24 can be safe while upstream 1.24 is not. Compare package versions with the distro's advisory, not with the upstream number.

On RHEL 9 the default package is nginx 1.20; newer versions come as module streams that you enable with dnf module enable nginx:<stream>. Red Hat backports fixes into each stream.

The nginx.org repositories ship the upstream stable line (or mainline, if you enable it) for RHEL 8–10, Debian 12 and 13, Ubuntu 22.04, 24.04 and 26.04, SLES 15 SP6+ and 16, Alpine 3.21–3.24 and Amazon Linux 2023. Use them if you want new upstream versions, or if your distro is slow with a fix that affects your setup. Follow the setup steps on the nginx.org Linux packages page and check that the signing key fingerprint is 573B FD6B 3D8F BC64 1079 A6AB ABF5 BD82 7BD9 BF62.

Update commands

# Debian, Ubuntu (distro or nginx.org repo)
sudo apt update
sudo apt install --only-upgrade nginx nginx-common

# RHEL, Rocky, AlmaLinux, Oracle Linux, Amazon Linux 2023
sudo dnf upgrade --refresh 'nginx*'

# SUSE
sudo zypper refresh
sudo zypper update nginx

# Alpine (as root)
apk -U upgrade nginx

# FreeBSD (as root)
pkg audit -F
pkg upgrade nginx

# Docker: pull the new image, then recreate the container
docker pull nginx:stable
docker compose up -d --pull always

On Debian and Ubuntu, add any dynamic module packages you use (names start with libnginx-mod-), or run sudo apt upgrade. For the Docker image, the stable tag currently points to 1.30.6 and mainline to 1.31.8. Pin the tag you use in your compose file, and rebuild your own images that start FROM nginx. If you built nginx from source, download the new tarball, check its PGP signature and rebuild with the same configure options shown by nginx -V.

Test, then restart

Always test the configuration first. If the test fails, the running nginx keeps its old configuration and you can fix the error without an outage.

sudo nginx -t && sudo systemctl restart nginx     # restarts the service
nginx -t && rc-service nginx restart               # Alpine, as root
service nginx configtest && service nginx restart  # FreeBSD, as root

A reload (systemctl reload nginx, signal HUP) loads new configuration only. The old binary stays in memory, so after a package update you need a restart. The restart drops connections for a moment. To swap the binary with no break, nginx supports an on-the-fly upgrade: send USR2 to the master, then WINCH to the old master, check the new processes, and finally send QUIT to the old master. The "Controlling nginx" page also explains how to roll back. If you serve HTTP/3, enable quic_bpf to keep QUIC connections during reloads and upgrades.

Verify the fix

nginx -v
sudo ls -l /proc/$(pgrep -o -x nginx)/exe        # "(deleted)" means the old binary still runs
ps -eo pid,lstart,cmd | grep '[n]ginx: master'

The master should have started after the update. Then load your site and watch the error log for a few minutes. On Debian and Ubuntu, compare the package version with the fixed version in the DSA or USN.

Where advisories appear

• nginx.org security advisories: each entry lists severity, CVE, vulnerable versions and fixed versions.
• The news list on the nginx.org home page announces each release and names the CVEs it fixes. The GitHub releases feed works in any feed reader.
• If you use the njs module, watch its releases too. njs 1.0.2 fixed two CVEs on October 14, 2026.
• Your distribution's tracker for backported fixes. Our vulnerability pages collect the important ones.

Quick hardening tips

• Add server_tokens off; in the http block so error pages and headers don't show the exact version.
• Enable HTTP/3 only if you need it. Three of the last twelve nginx advisories were in HTTP/3 code.
• Remove modules and directives you don't use, such as SSI, slice or charset. Recent advisories hit each of them.
• Check every alias: a location without a trailing slash paired with an alias that has one (location /img { alias /data/img/; }) can expose files outside the folder.
• Set ssl_protocols TLSv1.2 TLSv1.3; and keep OpenSSL patched (see OpenSSL).
• Restrict stub_status and admin locations with allow and deny.
• Set client_max_body_size and use limit_req on login and API endpoints.
• Keep the config in version control and run nginx -t before every deploy.

Sources

• nginx: download, nginx.org
• nginx security advisories, nginx.org
• nginx news, nginx.org
• nginx: Linux packages, nginx.org
• Controlling nginx, nginx.org
• nginx security policy, GitHub
• CVE-2026-15176, Debian Security Tracker
• CVE-2026-15176, Ubuntu Security
• nginx package versions, Debian
• nginx package versions, Ubuntu
• Setting up and configuring NGINX, RHEL 9 documentation, Red Hat
• nginx package, Alpine Linux v3.24
• www/nginx, FreshPorts
• nginx Docker Official Image documentation, docker-library