F5 ships out-of-band patches for critical NGINX flaws
Original title: F5 releases out-of-band patches for critical NGINX vulnerabilities
Three critical bugs can crash NGINX or, if ASLR is off or bypassed, allow code execution; F5 reports no exploitation.
F5 released out-of-band patches for multiple NGINX flaws, including three critical issues in ngx_http_v3_module and the map directive. Unprivileged remote attackers can cause denial of service or, on non-default setups, code execution via a heap buffer overflow or use-after-free in the worker process. Affected products include NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager. F5 has not flagged the issues as exploited.
Unconfirmed: F5 has not flagged exploitation; the report separately notes past abuse of other F5 flaws.
- CVE-2026-15176 and CVE-2026-97205 are in ngx_http_v3_module.
- CVE-2026-93479 is in the NGINX map directive.
- Code execution needs ASLR disabled or bypassed.
- Workarounds include avoiding alias and $request_filename, and disabling AIO or SSI.
Impact: DoS or code execution on non-default NGINX setups
| Product | Affected |
|---|---|
| F5 NGINX Plus | — |
| F5 NGINX Open Source | — |
| F5 NGINX Ingress Controller | — |
| F5 NGINX Gateway Fabric | — |
| F5 NGINX Instance Manager | — |
- 1.Install F5's out-of-band patches for the affected NGINX products.
- 2.For CVE-2026-15176, avoid the alias directive and $request_filename.
- 3.For CVE-2026-97205, disable asynchronous file I/O or Server Side Includes.
- Vendors
- F5
- Products
- NGINX PlusNGINX Open SourceNGINX Ingress ControllerNGINX Gateway FabricNGINX Instance Manager
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-15176+2 related CVEs | NGINX heap overflow via alias and $request_filename | 9.2 | — |
From the original article
2 min read at bleepingcomputer.com
F5 has released out-of-band security patches to address multiple NGINX web server flaws, including three critical-severity vulnerabilities that can let attackers execute code on vulnerable systems. [...]
By Sergiu Gatlan · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.