F5 Releases Out-of-Band Patches for Three Critical NGINX Vulnerabilities

F5 Ships Emergency Fixes for Three Critical NGINX Flaws

F5 released an out-of-band security advisory on October 14, 2026, patching 11 vulnerabilities across its NGINX product line, including three critical-severity bugs — CVE-2026-15176, CVE-2026-93479, and CVE-2026-97205 — that can let an unauthenticated, remote attacker crash NGINX worker processes or, under certain conditions, achieve code execution. All three critical flaws carry a CVSS v3.1 score of 8.1 (High) but are rated 9.2 (Critical) under CVSS v4.0, and affect a wide swath of the NGINX ecosystem — NGINX Open Source, NGINX Plus, NGINX Ingress Controller, NGINX Gateway Fabric, NGINX Instance Manager, and the F5/NGINX App Protect WAF and DoS modules built on top of the core engine. As of publication, F5 says it has found no public proof-of-concept exploit code and no evidence of in-the-wild exploitation, but given NGINX's footprint as a reverse proxy, load balancer, API gateway, and Kubernetes ingress controller, security teams are being urged to patch immediately rather than wait for confirmed attacks.

Technical Details

How the Vulnerabilities Work

CVE-2026-15176 — heap buffer overflow via alias and $request_filename

This flaw lives in the ngx_http_core_module and is triggered in configurations that combine the alias directive inside a location block with a rewrite rule and a set or return directive that references the $request_filename variable. A specially crafted HTTP request against that configuration can corrupt heap memory, crashing the worker process or, if ASLR is disabled or successfully bypassed, potentially achieving remote code execution. F5's workaround for sites that cannot patch immediately is to avoid pairing alias with $request_filename in affected location blocks.

CVE-2026-93479 — heap buffer overflow in the map directive

This bug affects NGINX configurations that use the map directive with regular-expression matching and reference the resulting capture variables elsewhere in the configuration. Malformed input that reaches the regex-capture handling path can overflow a heap buffer, again producing a worker crash or code execution under the same ASLR-dependent conditions. F5 recommends using named regex captures instead of unnamed ones and scoping their use tightly to the block containing the regex match.

CVE-2026-97205 — use-after-free with AIO and SSI

The third critical flaw is a use-after-free condition in ngx_http_core_module that surfaces when a server has asynchronous file I/O (AIO) enabled alongside Server Side Includes (SSI), specifically when processing pages containing an include virtual directive. Triggering the race can corrupt memory and terminate the worker process unexpectedly, with code execution possible in the same reduced-mitigation scenarios as the other two bugs. The interim workaround is to disable AIO or SSI on affected servers until the patch can be applied.

Eight additional, lower-severity fixes

The remaining eight issues in the same advisory are rated moderate to high rather than critical, and span verification and validation bypass, sensitive information disclosure, request-attribute spoofing, data injection in proxied requests, unbounded memory growth, and access to protected paths prior to authentication. F5 has not published full exploitation details for these at the same depth as the three critical bugs, but they are patched in the same release and apply to overlapping sets of NGINX products.

Why an out-of-band release

F5 typically bundles NGINX fixes into its quarterly scheduled security notifications. Issuing this set of patches outside that cycle signals that F5 judged the combination of unauthenticated network reachability, broad product impact, and heap-corruption/use-after-free primitives serious enough to not wait for the next quarterly window — consistent with how F5 handled a comparable critical NGINX HTTP/3 flaw (CVE-2026-42530) and a separate map-directive regex bug (CVE-2026-42533) in an earlier July 2026 out-of-band cycle.

Impact Assessment

Recommendations

For infrastructure and platform admins

• Identify every NGINX Open Source, NGINX Plus, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager deployment in your environment and check its version against F5's advisory.
• Upgrade NGINX Open Source to 1.30.6 or 1.31.7, and NGINX Plus to 37.0.5.1 or 37.1.0.1, prioritizing any instance exposed to untrusted or internet-facing traffic.
• Where immediate patching isn't possible, apply the documented interim mitigations: avoid combining alias with $request_filename, disable AIO or SSI together, and switch to named regex captures scoped tightly in map configurations.
• Audit configuration files for the specific risky patterns (alias + rewrite + set/return referencing $request_filename; map blocks with unnamed regex captures; AIO enabled with include virtual SSI) to triage which hosts are actually exploitable versus merely running a vulnerable binary.

For security teams

• Treat internet-facing NGINX-based reverse proxies, API gateways, and ingress controllers as priority patch targets given the unauthenticated, network-based attack vector.
• Confirm ASLR is enabled and functioning on all Linux hosts running NGINX workers, since disabled or bypassed ASLR is what separates a crash from remote code execution in these bugs.
• Monitor for unusual NGINX worker crash-restart patterns in logs and monitoring dashboards, which could indicate exploitation attempts even before a working RCE chain is public.
• Track vendor advisories for downstream products that embed NGINX (WAF appliances, API gateways, CDN edge nodes, Kubernetes ingress) since they inherit the same vulnerable code paths on their own release cadence.

For Kubernetes and cloud-native operators

• Check the image tags and Helm chart versions of any NGINX Ingress Controller or NGINX Gateway Fabric deployments and plan a rolling upgrade to patched builds.
• Review ingress configuration annotations for alias-based rewrites or custom map directives that could reproduce the vulnerable patterns inside a cluster.
• Treat ingress-layer compromise as a cluster-wide risk during triage, since a single vulnerable ingress controller can front traffic for many namespaces and workloads.

Key Takeaways

1. F5 issued an out-of-band advisory on October 14, 2026 patching 11 NGINX vulnerabilities, three of them critical: CVE-2026-15176, CVE-2026-93479, and CVE-2026-97205.
2. All three critical bugs score 8.1 High (CVSS v3.1) / 9.2 Critical (CVSS v4.0) and stem from heap buffer overflows (alias/$request_filename, map regex captures) and a use-after-free (AIO plus SSI) in ngx_http_core_module.
3. Exploitation requires non-default configuration patterns and is unauthenticated and remote; outcomes range from worker-process crashes to remote code execution when ASLR is disabled or bypassed.
4. Fixed versions are NGINX Open Source 1.30.6 / 1.31.7 and NGINX Plus 37.0.5.1 / 37.1.0.1, with corresponding patches for NGINX Ingress Controller, NGINX Gateway Fabric, NGINX Instance Manager, and F5's WAF/DoS modules.
5. No public proof-of-concept or confirmed in-the-wild exploitation exists yet, but NGINX's role as a reverse proxy, API gateway, and Kubernetes ingress layer makes rapid patching a priority regardless.
6. Interim workarounds exist for each critical CVE (avoiding specific directive combinations, disabling AIO/SSI, using named regex captures) for environments that cannot patch immediately.

Sources

• F5 releases out-of-band patches for critical NGINX vulnerabilities — BleepingComputer
• F5, Juniper Networks Patch Critical Vulnerabilities — SecurityWeek
• F5 Patches Three Critical NGINX Vulnerabilities in Core — SecurityOnline