F5 ships emergency patches for three critical NGINX flaws
Original title: F5 rushes out emergency NGINX patches for three critical flaws
All three CVEs score 9.2; F5 says it has found no evidence of exploitation and urges upgrades.
F5 released out-of-band patches for three critical NGINX flaws, CVE-2026-15176, CVE-2026-97205, and CVE-2026-93479, each scored 9.2 under CVSS 4.0. The issues can crash worker processes through heap buffer overflows and, when ASLR is disabled or bypassed, allow code execution and denial of service. Affected products are NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager. F5 says it has not found evidence of exploitation and gives configuration workarounds.
Unconfirmed: F5 reports no evidence of exploitation; fixed version numbers are not stated in the article.
- CVE-2026-15176 and CVE-2026-97205 are in ngx_http_core_module.
- CVE-2026-93479 is a map directive flaw triggered by crafted HTTP requests.
- F5 suggests avoiding $request_filename with alias, disabling AIO and SSI, and using named captures.
- Analysts say RCE risk rises when ASLR is disabled and that NGINX may be embedded in other products.
Impact: Worker crash, denial of service, or code execution
| Product | Affected |
|---|---|
| F5 NGINX Plus | — |
| F5 NGINX Open Source | — |
| F5 NGINX Ingress Controller | — |
| F5 NGINX Gateway Fabric | — |
| F5 NGINX Instance Manager | — |
- 1.Install or upgrade to the fixed versions F5 released.
- 2.Apply the named configuration workarounds if patching is delayed.
- 3.Inventory embedded NGINX and confirm ASLR is enabled.
- Vendors
- F5
- Products
- NGINX PlusNGINX Open SourceNGINX Ingress ControllerNGINX Gateway FabricNGINX Instance Manager
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-15176+2 related CVEs | NGINX heap overflow via alias and $request_filename | 9.2 | — |
From the original article
4 min read at csoonline.com
F5 is once again disclosing cybersecurity flaws in its core offerings. The app delivery and security provider has released out-of-band (OOB) security patches that address multiple flaws in NGINX, its high-performance software that controls digital traffic for websites. These include three critical-severity flaws that could allow attackers to crash systems, execute code, and launch denial of service (DoS) attacks.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.