NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks

NGINX has disclosed five security vulnerabilities — three memory-related bugs enabling potential remote code execution or worker crashes, one TLS flaw that can bypass client certificate authentication, and an HTTP/3 input validation issue. The TLS flaw is particularly concerning because client certificate checks are a critical access control mechanism; bypassing them could allow unauthorized actors to impersonate trusted clients. One vulnerability traces back to May 2005, highlighting how long-lived software defects can persist undetected in foundational infrastructure. These flaws underscore the risk of running unpatched, widely-deployed web servers in internet-facing environments. Prompt patching is essential even when no active exploitation has been confirmed, as threat actors rapidly weaponize disclosed CVEs.