F5 patches three critical NGINX flaws; no exploitation seen
No reports after October 23 add facts beyond the October 25 account; that note already covered open-source versions and advisory K000163408.
F5 has shipped out-of-band NGINX patches for three critical flaws and reports no evidence of exploitation.
F5 released out-of-band patches for three critical NGINX vulnerabilities, CVE-2026-15176, CVE-2026-97205, and CVE-2026-93479, each scored 9.2 under CVSS 4.0 by CSO Online. Unprivileged remote attackers can crash worker processes and, when ASLR is disabled or bypassed, execute code. BleepingComputer places the first two flaws in ngx_http_v3_module and describes a heap buffer overflow or use-after-free; CSO Online places them in ngx_http_core_module and describes heap buffer overflows. CVE-2026-93479 is a map-directive issue. Open-source nginx before 1.31.7 or 1.30.6 is affected, along with NGINX Plus, Ingress Controller, Gateway Fabric, and Instance Manager. F5 reports no exploitation evidence and offers configuration workarounds.
- CVE-2026-15176, CVE-2026-97205, and CVE-2026-93479 each score 9.2 (CVSS 4.0).
- Code execution requires ASLR disabled or bypassed; default setups face denial of service.
- Open-source nginx before 1.31.7 or 1.30.6 is affected, per an oss-security post.
- Workarounds: avoid alias with $request_filename; disable AIO or SSI; use named captures.
- F5 advisory K000163408 and nginx.org advisories document the fixes.
Timeline
dated events in the reporting · oldest first- Oct 19, 2026F5 releases out-of-band patches for critical NGINX flaws · BleepingComputer
- Oct 20, 2026CSO Online reports CVSS 9.2 and no exploitation evidence · CSO Online
- Oct 23, 2026oss-security cites open-source fixes before 1.31.7 or 1.30.6 · oss-security
What each outlet adds
beyond the shared facts- BleepingComputerPlaces two bugs in ngx_http_v3_module and mentions use-after-free.
- CSO OnlineScores all three 9.2 and places them in ngx_http_core_module.
- oss-securityGives open-source versions and cites advisory K000163408.
- Vendors
- F5
- Products
- NGINX PlusNGINX Open SourceNGINX Ingress ControllerNGINX Gateway FabricNGINX Instance Managernginx
- Organizations
- CISA
Coverage
oldest first · one row per article · UTC- · 6d ago
BleepingComputerFirst report
F5 ships out-of-band patches for critical NGINX flaws
Three critical bugs can crash NGINX or, if ASLR is off or bypassed, allow code execution; F5 reports no exploitation.
- · 5d ago
CSO Online
F5 ships emergency patches for three critical NGINX flaws
All three CVEs score 9.2; F5 says it has found no evidence of exploitation and urges upgrades.
- · 2d ago
oss-security
Open source nginx before 1.31.7 or 1.30.6 may allow RCE
An oss-security post says at least two F5-published nginx issues may allow remote code execution.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-15176+2 related CVEs | NGINX heap overflow via alias and $request_filename | 9.2 | — |