F5 releases out-of-band patches for three critical NGINX flaws

On October 19, 2026, F5 released out‑of‑band patches for NGINX addressing several flaws, three of which are rated critical. The updates fix issues in the ngx_http_v3_module and the map directive that could let unauthenticated remote attackers run code or trigger a denial‑of‑service when NGINX uses non‑default settings.

Affected NGINX versions range from 1.30.0 to 1.30.5 and 1.31.2 to 1.31.6; patched versions are 1.30.6 (stable) and 1.31.7 (mainline). Systems patched in Jul. 2026 remain within the affected range, requiring upgrade to the new releases.

The patches apply to NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager.

F5 assigns a CVSS v4.0 score of 9.2, labeled Critical, to each of the memory vulnerabilities CVE‑2026‑15176, CVE‑2026‑97205 and CVE‑2026‑93479. NGINX rates all five vulnerabilities as medium, while F5 scores the TLS flaw at 8.3 and the HTTP/3 flaw at 6.9 on CVSS v4.0.

F5 scores the three memory bugs 9.2, Critical, on CVSS v4.0, the TLS flaw 8.3, and the HTTP/3 flaw 6.9.

The Hacker News, The Hacker News

Administrators can reduce the risk of CVE‑2026‑15176 by not using the alias directive inside a location block or referencing the $request_filename variable. Mitigation for CVE-2026-97205 involves disabling asynchronous file I/O (AIO) or Server Side Includes (SSI). For CVE‑2026‑93479, the advice is to replace unnamed captures with named ones and confine their use to the same block where the regex match occurs.

F5 says none of these flaws have appeared in active exploitation, and NGINX has not reported any attacks that use them. Starting in Nov. 2021, CISA has marked eight F5 flaws as exploited in the wild, with four of those also appearing in ransomware campaigns. In an Oct. 2025 disclosure, F5 said state‑backed intruders compromised its networks in Aug. 2025 and exfiltrated source code plus details on undisclosed BIG‑IP security issues.

F5 provides cybersecurity, application delivery networking, and other services to over 23,000 customers, including 80% of the Fortune Global 500 and 48 Fortune 50 companies. NGINX sees broad deployment as a web server, reverse proxy, load balancer and application delivery platform. The three critical flaws are in the ngx_http_v3_module—specifically CVE‑2026‑15176 and CVE‑2026‑97205—and in the NGINX map directive as CVE‑2026‑93479.

If exploited, the bugs trigger a heap-based buffer overflow or use-after-free in the NGINX worker process, which can crash the process or force a restart. When address‑space layout randomization is turned off or can be circumvented, the same memory corruption could allow arbitrary code execution on the NGINX host.

One of the five vulnerabilities fixed in NGINX 1.30.6 and 1.31.7 has existed in every NGINX release since May 2005. NGINX released versions 1.30.6 and 1.31.7 on October 14, 2026 to address the five vulnerabilities.

Each of the five flaws can only be triggered when a specific setting is present: an alias paired with rewrite, a regex‑based map, AIO combined with SSI, a shared TLS session cache, or HTTP/3 support. NGINX’s documentation advises using a shared TLS session cache and request buffering, noting that the condition exposing the HTTP/3 flaw defaults to enabled.

Older NGINX branches such as the 1.28 series remain inside the vulnerable version ranges, and a distribution’s NGINX package qualifies as patched only when the distributor has backported the fixes. Administrators can detect risky NGINX configs by running `nginx -T` and searching for alias beside rewrite, regex map used by root/log_format, aio with ssi, quic listen lines, and shared TLS cache without ticket key.

VulnCheck observed that the rewrite-module overflow CVE-2026-42945, patched in May, was exploited within days of disclosure, marking this as NGINX’s eighth security update for 2026.