F5 ships emergency patches for three critical NGINX flaws
All three CVEs score 9.2; F5 says it has found no evidence of exploitation and urges upgrades.
76
Product
NGINX Instance Manager
- Mentions · 7d2
- Mentions · 30d3
- All mentions3
- First seenOct 15, 2026
- Last mentioned5d ago
Timeline
3 articles · newest firstF5 ships out-of-band patches for critical NGINX flaws
Three critical bugs can crash NGINX or, if ASLR is off or bypassed, allow code execution; F5 reports no exploitation.
78
F5 security advisory (AV26-1049)
Canada’s Cyber Centre urges updates for multiple NGINX and F5 products affected by three new CVEs.
38
Related CVEs
by mentions- NGINX heap overflow via alias and $request_filename
- Heap buffer overflow in NGINX map regex handling
- Use-after-free in NGINX when AIO and SSI are enabled
- Auth bypass in F5 NGINX Ingress Controller externalAuth
- njs XML entity attributes bypass nginx-saml checks
Appears with
- NGINX Gateway Fabricproduct · 3
- NGINX Plusproduct · 3
- F5vendor · 3
- NGINX Ingress Controllerproduct · 3
- NGINX Open Sourceproduct · 2
- CISAorganization · 2
- F5 WAF for NGINXproduct · 1
- NGINXproduct · 1
- F5organization · 1
- Canadian Centre for Cyber Securityorganization · 1
- F5 DoS for NGINXproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.