F5 Issues Emergency NGINX Patches for Three Critical Vulnerabilities
NGINX sits at the edge of many enterprise systems, routing traffic and often handling encrypted connections. That makes three newly patched flaws more than a software maintenance issue: depending on configuration, they could let attackers crash servers, disrupt access or execute code.
F5 released out-of-band security updates for NGINX, outside its usual maintenance cycle. The three vulnerabilities—CVE-2026-15176, CVE-2026-97205 and CVE-2026-93479—each have a severity score of 9.2 under CVSS version 4.0. They affect NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric and NGINX Instance Manager.
F5 says it has found no evidence of in-the-wild exploitation and recommends that customers install fixed versions or upgrade. Frank Dickson of Dickson Research described the potential exposure: “NGINX is the front door: Reverse proxy, load balancer, and Kubernetes ingress.” Because TLS often terminates there, he said, code execution could expose passwords, session cookies, API tokens and private keys.
Memory corruption creates availability and execution risks
CVE-2026-15176 and CVE-2026-97205 affect NGINX’s ngx_http_core_module. Both can trigger a heap buffer overflow in a worker process, potentially causing a crash or restart. F5 says an attacker could use the flaws for denial of service (DoS), or execute code if Address Space Layout Randomization (ASLR) is disabled or bypassed. ASLR randomizes memory locations when an application starts, making some exploits harder to carry out.
The third flaw, CVE-2026-93479, involves the map directive. Crafted HTTP requests could trigger a heap buffer overflow and, under the same ASLR conditions, potentially allow code execution.
F5 lists configuration workarounds for customers who need time to patch. For CVE-2026-15176, avoid using the $request_filename variable and the alias directive in a location block. For CVE-2026-97205, disable asynchronous file I/O (AIO) and Server Side Includes (SSI). For CVE-2026-93479, replace unnamed captures with named captures and keep their use within the block containing the regular expression match.
Seva Ioussoufovitch, senior research analyst at Infotech, said NGINX’s wide deployment could make availability losses significant for enterprises. The flaws follow another NGINX disclosure in June: CVE-2026-42530, in ngx_http_v3_module, which could also enable DoS or code execution.
Configuration audits matter as much as patch access
The new issues arrive amid a longer history of attacks targeting F5 products. Analysts noted that F5 serves tens of thousands of customers, including 80% of the Fortune 500. Over the past five years, the US Cybersecurity and Infrastructure Security Agency (CISA) has flagged eight actively exploited F5 vulnerabilities; four were used in ransomware attacks.
A 2025 nation-state breach and CISA Emergency Directive 26-01 centered on F5 BIG-IP. F5 said at the time that NGINX source code had not been accessed. Dickson pointed to a separate NGINX warning in May, when CVE-2026-42945, a rewrite module overflow nicknamed NGINX Rift, was disclosed alongside a public remote code execution proof of concept. “This week’s alias and rewrite flaw lives in the same neighborhood,” he said. “Attackers read changelogs, too.”
Ioussoufovitch recommends starting with an inventory of NGINX deployments and an audit of their configurations, since exposure depends on how the software is set up. Teams should include NGINX embedded in other products, then use the inventory to prioritize patching, review segmentation and monitor worker processes for repeated restarts that could signal probing.
Distribution channels complicate the task. Dickson said NGINX can be buried in ingress controllers, appliances and container images, and many organizations receive it through a Linux distribution rather than nginx.org. Amazon Linux still lists the AIO fix as pending, he said. “A fix on the vendor’s site does not patch your servers.”
For a focused configuration review, look for aliases paired with rewrite directives, AIO used with SSI, and map blocks that rely on unnamed regular expression captures. Also confirm that ASLR and other operating system protections are enabled, run NGINX workers without elevated privileges, and restrict what the traffic-facing systems can reach.
“These flaws need the right configuration to bite, and that is the good news,” Dickson said. “The bad news is that many organizations may not know what their NGINX configurations actually say.” That gap makes asset discovery and configuration checks the practical first steps while teams roll out the fixes.
