CVE-2026-97629

Name of the Vulnerable Software and Affected Versions NGINX Plus (affected versions not specified) NGINX Open Source (affected versions not specified)

Description When configured with ssl session cache shared:name:size without explicit ssl session ticket key file directives for automatic rotation of SSL session ticket keys, a remote unauthenticated attacker can forge client SSL sessions. This process is non-deterministic and beyond the attacker's control, but it can be used to bypass the verification of client certificates. This data plane issue may lead to the exposure of sensitive information or functionality to unauthorized actors.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.