All vulnerabilities
CVE-2026-97629

NGINX ngx_http_ssl_module vulnerability

F5 NGINX PlusWeb servers
Open in ThreatlineRecord JSON
CVSS
6.5Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in37.1.0.1Also 37.0.5.1, 1.31.7 and 1 moreCVE List
Published14 Oct 2026Updated 15 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Vendor and government advisories 1

Vendors that say their products are affected, and agencies that issued alerts. Check each for the fixed release of the product you run.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

Description

Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache

shared:name:size

without an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions

in a non-deterministic manner that is beyond the attacker's control. An attacker could leverage this vulnerability to bypass verification of client certificates.

Impact

This vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information. There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Text from CVE List

Affected versions 9

  • NGINX Plusaffected: 37.1.0 before 37.1.0.1CVE List
  • NGINX Plusaffected: 37.0.0 before 37.0.5.1CVE List
  • NGINX Plusaffected: R36 and laterCVE List
  • NGINX Plusaffected: R35 and laterCVE List
  • NGINX Plusaffected: R34 and laterCVE List
  • NGINX Plusaffected: R33 and laterCVE List
  • NGINX Open Sourceaffected: 1.31.0 before 1.31.7CVE List
  • NGINX Open Sourceaffected: 1.30.0 before 1.30.6CVE List
  • NGINX Open Sourceaffected: 1.23.3 and laterCVE List

References 1