NGINX patches five flaws, including a TLS bug that skips client-certificate checks

On October 14, 2026, NGINX released versions 1.30.6 and 1.31.7 to fix five vulnerabilities, including a TLS session-ticket key rotation bug that can let a forged session bypass client-certificate verification. Upgrade, or at minimum remove the shared TLS session cache if your server relies on client-certificate authentication.