Key points
- F5 released fixes for eleven security issues, including three rated critical.
- CVE-2026-15176 allows unauthenticated attackers to trigger heap buffer overflows.
- Remote code execution is possible if ASLR is disabled or bypassed on affected systems.
F5 released updates for NGINX Plus and NGINX Open Source to address CVE-2026-15176 and other vulnerabilities. The National Vulnerability Database rates CVE-2026-15176 as high severity with a CVSS score of 8.1. Affected versions include NGINX Plus before 37.1.0.1 and 37.0.5.1, and NGINX Open Source before 1.31.7 and 1.30.6. Patches are available for all listed versions.
In plain English
This flaw lets attackers send special web requests to crash your server or run code on it. It happens when NGINX is set up using the alias directive with rewrite rules that use the $request_filename variable. If your server logs access using this variable, it is also at risk. The issue causes a memory error known as a heap buffer overflow.
The background
According to Security Affairs, F5 fixed eleven issues, including two others rated critical. CVE-2026-93479 involves map directive variables and CVE-2026-97205 involves asynchronous file I/O. All three critical flaws share similar traits: they require no login, cause crashes, and may allow code execution if memory protections like ASLR are off.
What changes now
Administrators must upgrade to the patched versions immediately. The fixes resolve the heap overflow and use-after-free errors described in the advisories. No workaround is mentioned in the source material, so updating the software is the only confirmed way to stop exploitation. Systems running end-of-life versions are not covered by these evaluations.
Who needs to act first
Teams usually prioritize systems exposed directly to the internet for immediate patching. Check whether your configurations use the alias directive or specific logging formats mentioned in the advisory. If you cannot patch right away, consider restricting access to the affected services. Back up your configuration files before applying updates to ensure you can revert if issues arise. Test the new version in a staging environment first to verify stability.
What to do and how to stay safe: NGINX
- Verify if your NGINX instances use the alias directive with rewrite rules referencing $request_filename.
- Check your access log formats to see if they include the $request_filename variable.
- Ensure Address Space Layout Randomization (ASLR) is enabled on your servers to mitigate code execution risks.
- Monitor logs for unusual worker process restarts or crashes that may indicate exploitation attempts.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which NGINX versions are affected by CVE-2026-15176?
NGINX Plus versions before 37.1.0.1 and 37.0.5.1, and NGINX Open Source versions before 1.31.7 and 1.30.6.
Can attackers execute code remotely using this flaw?
Yes, remote code execution is possible if ASLR is disabled or if the attacker can bypass it.
Is this vulnerability limited to specific configurations?
Yes, it affects setups using the alias directive with rewrite and set or return directives referencing $request_filename.
