NGINX 1.30.6/1.31.7: Why the Medium Rating Understates Three CVSS 9.2 Bugs

NGINX labels all five October 2026 fixes medium. F5, the company behind NGINX, scores three of them 9.2 Critical on CVSS v4.0. The gap is not a mistake in either document; it reflects two different measurement philosophies, and understanding the difference is what tells an operator how fast to move.

The five in one place

CVE-2026-15176 is a heap overflow reached through an alias location that rewrites and reads $request_filename ; affected releases run from 0.1.29 to 1.31.6. CVE-2026-93479 is a heap overflow where a regex map has its captures referenced by root or log_format ; affected branches are 1.30.0 to 1.30.5 and 1.31.2 to 1.31.6. CVE-2026-97205 is a use-after-free requiring aio with SSI include virtual pages. CVE-2026-95101 is the HTTP/3 parser bug that can inject bytes past client_max_body_size . CVE-2026-97629 is the TLS session-ticket forgery.

The three memory bugs carry the 9.2. The TLS flaw carries 8.3.…