Key points
- Patches address CVE-2026-15176, CVE-2026-97205, and CVE-2026-93479 in NGINX products.
- Exploits can cause heap buffer overflows or use-after-free errors leading to crashes.
- Mitigations exist for those who cannot immediately install the security updates.
F5 released out-of-band security patches to fix three critical vulnerabilities in NGINX web server software. These flaws affect NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager. The updates address issues that could allow attackers to execute code on vulnerable systems.
In plain English
The vulnerabilities reside in the ngx_http_v3_module and the NGINX map directive. Specifically, CVE-2026-15176 and CVE-2026-97205 are in the module, while CVE-2026-93479 is in the map directive. Attackers do not need privileges to exploit these flaws. They can trigger denial-of-service attacks or gain code execution on systems using non-default configurations.
Successful exploitation causes a heap-based buffer overflow or use-after-free error in the NGINX worker process. This leads to system crashes or restarts. However, attackers may also execute code if Address Space Layout Randomization is disabled or if they can bypass it. F5 rates these three vulnerabilities as critical severity.
The background
F5 has not flagged these specific issues as exploited in the wild. However, cybercrime and nation-state groups have often targeted F5 products in recent years. Attackers have used F5 flaws to breach networks, map servers, and steal documents. CISA has flagged eight F5 vulnerabilities as actively exploited since November 2021.
In October 2025, F5 disclosed that state-sponsored actors breached its systems in August 2025. Those attackers stole source code and information on undisclosed BIG-IP vulnerabilities. This history highlights the persistent risk associated with F5 infrastructure components.
What changes now
Administrators must install the new patches immediately. For those who cannot patch right away, F5 provided specific mitigations. Users can reduce risk for CVE-2026-15176 by avoiding the 'alias' directive in location blocks or the $request_filename variable. For CVE-2026-97205, teams should disable asynchronous file I/O or Server Side Includes.
To mitigate CVE-2026-93479, administrators should use named captures instead of unnamed ones. They must also limit the use of these captures to the block containing the regex match. These steps reduce exposure until the patches are applied.
Who needs to act first
Teams should prioritize systems exposed to the internet or untrusted networks. Identify servers running non-default NGINX configurations first. Test the patches in a staging environment to ensure compatibility with your applications. Back up current configurations before applying changes. If patching is delayed, implement the vendor-suggested mitigations immediately. Monitor logs for signs of exploitation attempts.
What to do and how to stay safe: F5
- Inventory all NGINX instances, including Plus, Open Source, and controllers, to determine version status.
- Apply the out-of-band patches provided by F5 to all affected servers as soon as possible.
- If immediate patching is impossible, configure the specific mitigations for each CVE as described by the vendor.
- Monitor system logs for unexpected crashes or restarts that may indicate exploitation attempts.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which NGINX products are affected by these vulnerabilities?
NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager are affected.
Are these vulnerabilities being exploited in the wild?
F5 has not yet flagged these specific security issues as exploited in the wild.
What is the severity of these vulnerabilities?
F5 rates the three vulnerabilities as critical severity.
