CVE-2026-97629: NGINX SSL Session Cache Vulnerability
Summary
CVE-2026-97629: NGINX ngx_http_ssl_module vulnerability. Affects nginx across 2 version ranges.
>= 0.1.29, < 1.30.6
>= 1.31.0, < 1.31.7
Fixed in 1.30.6 or 1.31.7, depending on the release line you run. How to fix ↓
Also tracked for
- nginx-gateway · Bitnami
The same CVE-2026-97629 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NGINX is a high-performance web server and reverse proxy server, widely used for serving static content and as a load balancer. It supports various features including SSL/TLS for secure communications. However, certain configurations, particularly those involving the ssl_session_cache directive, can expose it to vulnerabilities if not properly managed.
Vulnerability Detail
The vulnerability arises when NGINX Plus or NGINX Open Source is configured with the ssl_session_cache shared:name:size directive without an explicit ssl_session_ticket_key file. This misconfiguration allows a remote unauthenticated attacker to forge client SSL sessions in a non-deterministic manner, potentially bypassing client certificate verification. The implications of this vulnerability could lead to unauthorized access to sensitive information, as it exposes resources to unintended actors. It is a data plane issue, meaning it affects the data being processed rather than the control mechanisms of the server.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 0.1.29, < 1.30.61.30.6 -
>= 1.31.0, < 1.31.71.31.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can disable the SSL session ticket feature by setting 'ssl_session_tickets off;' in your NGINX configuration file. However, this may impact performance and should only be used until a proper fix is applied.
Conclusion
CVE-2026-97629 presents a significant security risk for NGINX users who have not configured their SSL session cache correctly. It is crucial to update to the latest patched versions and to ensure proper configuration to mitigate potential exploitation.
See every vulnerability recorded for nginx →
FAQ
CVE-2026-97629 is a vulnerability in NGINX that allows attackers to forge client SSL sessions due to improper configuration of the SSL session cache.
You can use the Vulert platform to monitor and alert for vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
The risks include unauthorized access to sensitive information and the potential for attackers to bypass client certificate verification.
You can update NGINX by running 'sudo apt-get update nginx' or downloading the latest version from the official NGINX website.
Yes, you can temporarily disable SSL session tickets by adding 'ssl_session_tickets off;' to your NGINX configuration, but this should only be a short-term solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for nginx.
