When variables were used in the root or alias directives, or
in the log file path of the access_log directive in the HTTP
module or the access_log directive in the stream module, worker
process memory corruption or a worker process crash could occur
(CVE-2026-93479).
When the ssl_session_cache directive was used with the shared
parameter without the ssl_session_ticket_key directive, an
attacker could forge a TLS session and bypass client certificate
verification (CVE-2026-97629).
When requests received over HTTP/3 were proxied, a part of an
unknown frame might be treated as the request body, which might
result in bypassing the client_max_body_size limit or injecting
data into the proxied request (CVE-2026-95101).
When the alias directive was used, if the request URI was
changed by the rewrite directive and the $request_filename
variable was evaluated afterwards, worker process memory
corruption or a worker process crash could occur
(CVE-2026-15176).
When asynchronous file I/O (aio) was used in certain
configurations, if an SSI page contained include virtual
commands, worker process memory corruption or a worker process
crash could occur (CVE-2026-97205).