cyber.hendryadrian.com
Vulnerability & Exploit · bleepingcomputer.com

F5 Releases Out-of-Band Patches for Critical NGINX Vulnerabilities

· Original article ↗

Summary

F5 issued out-of-band patches for three critical NGINX vulnerabilities that could enable denial-of-service or code execution under non-default configurations. The article also outlines mitigations; F5 has not flagged the flaws as exploited in the wild.

Key points

  • The three critical flaws are CVE-2026-15176 and CVE-2026-97205 in ngx_http_v3_module, and CVE-2026-93479 in the NGINX map directive.
  • Remote attackers without privileges may trigger denial-of-service or code execution on systems with non-default configurations.
  • Exploitation can cause a heap-based buffer overflow or use-after-free in the NGINX worker process; code execution may be possible when ASLR is disabled or bypassed.
  • F5 released patches for affected products including NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager.
  • Mitigations include avoiding specified NGINX directives or variables, disabling AIO or SSI for CVE-2026-97205, and using named captures with CVE-2026-93479.
  • F5 has not flagged the vulnerabilities as exploited in the wild. The article notes prior exploitation of other F5 flaws, but does not report exploitation of these vulnerabilities.

Article Details

Vulnerability Types
  • Heap-based buffer overflow
  • Use-after-free
Severity
Critical
Exploitation Status
not_reported
Exploit Availability
unknown
Patch Status
available
Workarounds
  • For CVE-2026-15176, avoid using the 'alias' directive in a location block or the $request_filename variable.
  • For CVE-2026-97205, disable asynchronous file I/O (AIO) or Server Side Includes (SSI).
  • For CVE-2026-93479, use named captures instead of unnamed captures and limit their use to the block with the regex match.

CVE

CVE-2026-15176F5 · NGINX Open Source; F5 · NGINX PlusThe three critical vulnerabilities were found in the ngx_http_v3_module (CVE-2026-15176 and CVE-2026-97205) and the NGINX map directive (CVE-2026-93479).CVE-2026-93479F5 · NGINX Open Source; F5 · NGINX PlusThe three critical vulnerabilities were found in the ngx_http_v3_module (CVE-2026-15176 and CVE-2026-97205) and the NGINX map directive (CVE-2026-93479).CVE-2026-97205F5 · NGINX Open Source; F5 · NGINX PlusThe three critical vulnerabilities were found in the ngx_http_v3_module (CVE-2026-15176 and CVE-2026-97205) and the NGINX map directive (CVE-2026-93479).

Vendors

F5F5 releases out-of-band patches for critical NGINX vulnerabilities

Products

NGINX Gateway Fabricby these two vulnerabilities, including NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager.NGINX Ingress Controllerproducts affected by these two vulnerabilities, including NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager.NGINX Instance Managerincluding NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager.NGINX Open Sourcefor multiple NGINX software products affected by these two vulnerabilities, including NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager.NGINX Plussecurity patches for multiple NGINX software products affected by these two vulnerabilities, including NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager.

Related Articles