Key points
- Patches address CVE-2026-15176, CVE-2026-97205, and CVE-2026-93479 in NGINX Plus and Open Source.
- Exploits can lead to heap overflow or use-after-free errors, potentially enabling remote code execution.
- Mitigations are available for systems that cannot be patched immediately.
F5 has released emergency security updates for its NGINX software portfolio to fix three critical flaws. These vulnerabilities affect NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager. The patches are available now for administrators to deploy.
In plain English
The three issues involve the HTTP/3 module and the map directive in NGINX. Attackers can trigger these bugs from a distance without needing login credentials. This works only on systems with non-default settings. A successful attack causes the server worker process to crash or restart due to memory errors. In some cases, attackers can run their own code on the server.
The background
According to BleepingComputer, the vulnerabilities allow for denial-of-service attacks or code execution. The memory errors involve heap-based buffer overflows and use-after-free conditions. Attackers might execute code if Address Space Layout Randomization is disabled or bypassed. F5 has not stated that these specific flaws are being exploited in the wild currently.
What changes now
Administrators can apply the new patches to fix the issues. If immediate updating is impossible, specific configuration changes can reduce risk. For CVE-2026-15176, avoid using the alias directive or request filename variable. For CVE-2026-97205, disable asynchronous file I/O or server-side includes. Use named captures for CVE-2026-93479.
Who needs to act first
Teams usually prioritize systems facing the internet over internal ones. Check whether your NGINX configurations use non-default settings that match the vulnerable directives. Test the patch in a staging environment before pushing it to production servers. Back up current configurations to allow quick rollback if the update causes unexpected service interruptions.
What to do and how to stay safe: F5
- Identify all NGINX instances running Plus, Open Source, or related controller versions.
- Apply the out-of-band patches provided by F5 as soon as possible.
- If patching is delayed, implement the specific configuration mitigations listed by the vendor.
- Monitor server logs for unusual crashes or restarts that could indicate exploitation attempts.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which CVEs are being patched?
The updates address CVE-2026-15176, CVE-2026-97205, and CVE-2026-93479.
Are these vulnerabilities being exploited in the wild?
F5 has not flagged these specific issues as actively exploited yet.
What products need updating?
NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager.
