F5 patches critical NGINX vulnerabilities
F5 has issued out-of-band fixes for three critical NGINX flaws that can cause crashes, denial of service and possible code execution.
F5 has released out-of-band security patches for multiple NGINX vulnerabilities, including three rated critical, according to independent reporting from BleepingComputer and the company’s security advisories. The flaws affect NGINX components used in web servers, ingress controllers and related products. 123
The three critical issues are CVE-2026-15176 and CVE-2026-97205 in the ngx_http_v3_module, plus CVE-2026-93479 in the NGINX map directive. F5 says attackers may be able to trigger denial-of-service conditions or, in some configurations, execute code remotely. The affected systems require particular configurations or conditions, but administrators should still treat the patches as urgent because NGINX is widely deployed. 123
What the patches address
The reported failures include a heap-based buffer overflow and a use-after-free in the NGINX worker process. Successful exploitation can crash a worker or force a restart, while code execution may become possible where address-space layout randomisation is disabled or an attacker can bypass it. 12
F5 lists patches for NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric and NGINX Instance Manager. The exact fix depends on the product and release branch, so administrators should use F5’s advisories rather than assume one package update covers every deployment. 23
Teams that cannot patch immediately have temporary mitigations available. F5’s guidance includes avoiding the affected alias and request_filename combination for CVE-2026-15176, disabling asynchronous file I/O or Server Side Includes for CVE-2026-97205, and using named captures while limiting regex matches for CVE-2026-93479. These are stopgaps, not replacements for updating. 23
Why NGINX administrators should act
F5 has not reported exploitation in the wild for these issues, but internet-facing web infrastructure is routinely scanned for weaknesses. The company’s advisories also place the fixes in a broader security context: several older F5 vulnerabilities have been exploited by attackers, making a prompt inventory of exposed NGINX systems worthwhile. 12
Administrators should identify which NGINX products and configurations they operate, check the relevant F5 advisory, apply the matching update and review logs for crashes or unexpected worker restarts. Systems using non-default HTTP/3, alias, AIO or SSI configurations deserve particular attention. 23
Our opinion
The practical message is straightforward: do not wait for evidence of active exploitation before patching internet-facing NGINX. The configuration caveats make the risk more nuanced than a blanket “every server is compromised” warning, but they also make asset inventory essential. A team cannot know whether a mitigation applies until it knows which modules and directives are enabled. 12
F5’s out-of-band fixes cover several NGINX products. Operators should consult the vendor advisories for their exact version, apply the relevant patch and remove any temporary mitigation once the system is safely updated. 23