F5 Releases Emergency NGINX Patches for Three Critical Vulnerabilities

NGINX sits in the path of web traffic, often handling reverse proxying, load balancing, Kubernetes ingress and TLS termination. That makes F5’s emergency fixes for three critical flaws an operational priority: exploitation could disrupt services or expose sensitive data handled at the server’s edge.

F5 issued out-of-band patches for CVE-2026-15176, CVE-2026-97205 and CVE-2026-93479. Each carries a CVSS 4.0 severity score of 9.2. Affected products include NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric and NGINX Instance Manager. F5 says it has no evidence the vulnerabilities are being exploited in the wild, but recommends installing or upgrading to fixed versions.

Frank Dickson of Dickson Research described NGINX as “the front door” for many systems. When TLS terminates there, he said, code execution could expose passwords, session cookies, API tokens and the private keys used to protect them.

Three flaws, shared memory-corruption risks

CVE-2026-15176 and CVE-2026-97205 affect NGINX’s ngx_http_core_module. Under certain conditions, they can trigger a heap buffer overflow in a worker process. The resulting memory corruption could crash or restart a system, interrupt service, or allow code execution. F5 says exploitation may be possible when Address Space Layout Randomization (ASLR) is disabled, or if an attacker can bypass it. The flaws could also support denial-of-service attacks.

CVE-2026-93479 affects the map directive. Crafted HTTP requests could cause a heap buffer overflow, with similar potential for service disruption or code execution when ASLR is disabled or bypassed.

The disclosures follow another NGINX vulnerability reported in June: CVE-2026-42530, in the ngx_http_v3_module in NGINX Open Source, which could let remote attackers cause denial of service or execute code.

Configuration audits can guide patch priority

F5 provided configuration changes that can reduce exposure while teams prepare updates. For CVE-2026-15176, it recommends avoiding the $request_filename variable and the alias directive inside a location block. For CVE-2026-97205, disable asynchronous file I/O (AIO) and Server Side Includes (SSI). For CVE-2026-93479, replace unnamed captures with named captures and keep their use within the block containing the regular expression match.

Seva Ioussoufovitch, senior research analyst at Infotech, said the flaws depend on configuration. He recommends reviewing NGINX settings to prioritize patching, while checking that ASLR and other operating system protections are enabled. Because NGINX is widely deployed, he cautioned, the flaws could put service availability at risk across many enterprises.

Teams first need a reliable inventory of where NGINX runs, including embedded deployments. Dickson noted that it can be tucked into ingress controllers, appliances and container images; organizations may also receive it through Linux distributions instead of directly from nginx.org. Amazon Linux, he said, still listed the AIO fix as pending. “A fix on the vendor’s site does not patch your servers,” he warned.

After building that inventory, administrators can search configurations for aliases paired with rewrite rules, AIO used alongside SSI, and map blocks with unnamed regular-expression captures. Monitoring repeated worker restarts may also help reveal probing or exploitation attempts.

Patch reach extends beyond NGINX itself

F5 has faced repeated attacks against flaws in its products. The company serves tens of thousands of customers, including 80% of the Fortune 500, and attackers have used weaknesses in its systems to map internal servers, hijack devices, breach networks, steal documents and deploy data-wiping malware. Over the past five years, the US Cybersecurity and Infrastructure Security Agency (CISA) has flagged eight actively exploited F5 vulnerabilities; four were targeted in ransomware attacks.

A 2025 nation-state breach and CISA’s Emergency Directive 26-01 focused on F5 BIG-IP. At the time, F5 said NGINX source code had not been accessed. Dickson pointed to a separate warning in May, when CVE-2026-42945, a rewrite-module overflow nicknamed NGINX Rift, was disclosed with a public remote code execution proof of concept. “This week’s alias and rewrite flaw lives in the same neighborhood,” he said. “Attackers read changelogs, too.”

If patching has to wait, Dickson recommends disabling AIO or stopping service of SSI pages, switching map directives to named captures, confirming ASLR is enabled, running worker processes without elevated privileges, and segmenting NGINX so it cannot reach an organization’s most sensitive systems. The practical takeaway is to map each deployment to its actual configuration and patch source; the risk hinges on settings that many teams may not yet have inventoried.