F5 ships out-of-band NGINX patches for three critical flaws
The bugs need non-default configurations, but successful exploitation can crash a worker process or, in narrower cases, run code.
F5 has released out-of-band patches for several NGINX flaws, including three rated critical that could let remote, unprivileged attackers crash a worker process or run code on systems with non-default configurations, BleepingComputer reported.
The three are tracked as CVE-2026-15176 and CVE-2026-97205, both tied to the ngx_http_v3_module, and CVE-2026-93479, tied to the NGINX map directive. F5's advisories describe heap buffer overflows and a use-after-free in the worker process, causing crashes or restarts. Code execution is described as possible on systems where Address Space Layout Randomization is disabled or can be bypassed. F5 says there is no control plane exposure; the issue is in the data plane.
Patched products include NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric and NGINX Instance Manager.
For teams that can't patch right away, the report lists configuration workarounds: avoid the alias directive in a location block or the $request_filename variable for the first flaw, disable asynchronous file I/O or Server Side Includes for the second, and use named captures limited to the regex block for the map flaw.
F5 has not flagged these as exploited in the wild.
CVE references
Sources
- F5 releases out-of-band patches for critical NGINX vulnerabilitiesPrimarywww.bleepingcomputer.com
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning