F5 ships emergency patches for three critical NGINX flaws
All three CVEs score 9.2; F5 says it has found no evidence of exploitation and urges upgrades.
76
Product
NGINX Ingress Controller
- Mentions · 7d0
- Mentions · 30d3
- All mentions4
- First seenSep 3, 2026
- Last mentioned22d ago
Timeline
4 articles · newest firstF5 ships out-of-band patches for critical NGINX flaws
Three critical bugs can crash NGINX or, if ASLR is off or bypassed, allow code execution; F5 reports no exploitation.
78
F5 security advisory (AV26-1049)
Canada’s Cyber Centre urges updates for multiple NGINX and F5 products affected by three new CVEs.
38
F5 security advisory (AV26-878)
Canada's Cyber Centre relayed an F5 advisory (AV26-878) covering vulnerabilities in BIG-IP, BIG-IQ, NGINX components, and APM clients.
28
Related CVEs
by mentions- CVE-2026-15176<1%9.2NGINX heap overflow via alias and $request_filename
- Heap buffer overflow in NGINX map regex handling
- CVE-2026-97205<1%9.2Use-after-free in NGINX when AIO and SSI are enabled
- Auth bypass in F5 NGINX Ingress Controller externalAuth
- njs XML entity attributes bypass nginx-saml checks
Appears with
- F5vendor · 4
- NGINX Gateway Fabricproduct · 4
- NGINX Instance Managerproduct · 3
- NGINX Plusproduct · 3
- Canadian Centre for Cyber Securityorganization · 2
- NGINX Open Sourceproduct · 2
- CISAorganization · 2
- BIG-IQproduct · 1
- F5 DoS for NGINXproduct · 1
- NGINXproduct · 1
- F5 WAF for NGINXproduct · 1
- F5organization · 1
- BIG-IPproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.