F5 addressed critical RCE flaws in NGINX
F5 patched three critical NGINX flaws that can allow unauthenticated remote code execution.
F5 released fixes for eleven NGINX security issues, including three critical flaws scored CVSS 9.2. CVE-2026-15176 and CVE-2026-93479 are heap-based buffer overflows in NGINX Plus and NGINX Open Source that an unauthenticated attacker can trigger with crafted HTTP requests under specific alias, map, or variable configurations, causing a crash or possible remote code execution if ASLR is disabled or bypassed. CVE-2026-97205 is a use-after-free in ngx_http_core_module when asynchronous file I/O and Server Side Includes are used, which can crash workers or potentially allow code execution. The report does not describe active exploitation.
- F5 fixed eleven NGINX issues, including three CVSS 9.2 flaws.
- CVE-2026-15176 and CVE-2026-93479 are unauthenticated heap overflows.
- CVE-2026-97205 is a use-after-free in ngx_http_core_module with AIO and SSI.
- Code execution depends on specific configs and disabled or bypassed ASLR.
- No exploitation in the wild is reported.
- Vendors
- F5
- Products
- NGINX PlusNGINX Open Source
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-15176+2 related CVEs | NGINX heap overflow via alias and $request_filename | 9.2 | — |
From the original article
1 min read at securityaffairs.com
F5 addressed multiple vulnerabilities, including critical RCE flaws in NGINX that attackers could exploit without authentication. Security and application delivery firm F5 announced fixes for eleven security issues in NGINX. Among them, critical vulnerabilities tracked as CVE-2026-15176 and CVE-2026-93479 could be exploited without authentication via crafted HTTP requests.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.