A buffer overflow might occur in a worker process when using the
"alias" directive if the request URI was changed by the "rewrite"
directive and was then mapped to a file path (CVE-2026-15176).
A buffer overflow might occur in a worker process while evaluating
string expressions with variables, which affected the document root
calculation and request logging in the http and stream modules
(CVE-2026-93479).
When using HTTP/3 a part of an unknown frame might be treated as the
request body, which might result in bypassing the
"client_max_body_size" limit or injecting data in the proxied
request (CVE-2026-95101).
When using TLS session ticket key rotation, one of the keys was left
uninitialized, which might allow to forge a session (CVE-2026-97629).
When using asynchronous file I/O (AIO), use-after-free might occur in
certain configurations if the SSI page has "include virtual" commands
(CVE-2026-97205).