Ubuntu fixes five vulnerabilities in nginx (USN-8955-1)

What happened and what to do

The USN-8955-1 advisory from Ubuntu Security reports that five nginx vulnerabilities have been fixed. Three CVEs can lead to denial of service or code execution: the combination of the alias directive with rewrite rules (CVE-2026-15176), map directives using regex matching (CVE-2026-93479) and asynchronous file I/O in Server Side Includes pages (CVE-2026-97205). CVE-2026-95101 allows injecting data into proxied requests over HTTP/3 when proxy_request_buffering is enabled, affecting only Ubuntu 26.04 LTS and 26.10. CVE-2026-97629 concerns SSL session ticket keys with a shared session cache and no explicit key rotation, which allows forging client SSL sessions and bypassing client certificate verification; it affects Ubuntu 24.04 LTS, 26.04 LTS and 26.10.

For a company, the first step is to inventory where nginx runs as a reverse proxy, API gateway or TLS terminator, and apply the updates on the affected Ubuntu releases. Next, review configurations that combine alias with rewrite, regex-based maps, SSI and proxy_request_buffering with HTTP/3, and confirm session ticket key rotation. Continuous monitoring of error logs and process restarts helps detect denial of service exploitation attempts, and a dashboard showing the nginx version on each host makes it easier to prove the fix. When nginx protects inference endpoints or internal APIs, it is also worth validating that client certificate authentication does not rely solely on the session cache.

How the consultancy can help

Diagnosis of your infrastructure's exposure to the five flaws, with a version inventory and risky configuration review, followed by a remediation plan and continuous monitoring of errors and versions on your own infrastructure.

Next step

Send a short description of how nginx is used in your environment and receive a scoped proposal for diagnosis and remediation.