F5 has released out-of-band security patches for several flaws in the NGINX web server, including three rated critical. Two are in the HTTP/3 module (ngx_http_v3_module, CVE-2026-15176 and CVE-2026-97205) and one is in the NGINX map directive (CVE-2026-93479). According to BleepingComputer’s reporting on F5’s advisories, remote attackers without privileges can exploit them to cause a denial of service or, on systems with non-default configurations, gain code execution.
The bugs cause a heap-based buffer overflow or a use-after-free in the NGINX worker process, which normally means a crash and restart. F5 says attackers may also be able to execute code when Address Space Layout Randomization (ASLR) is disabled or when the attacker can bypass it. F5 has not flagged any of the three as exploited in the wild. BleepingComputer notes that F5 products have been frequent targets of both cybercrime and state-backed groups, and that CISA lists eight F5 vulnerabilities as actively exploited since November 2021.
How to check if you’re affected
Affected products are the NGINX software lines F5 patched: NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric and NGINX Instance Manager. The advisories linked below list the exact affected and fixed versions for each product, so compare your installed version against them rather than relying on a summary.
The critical flaws need specific, non-default configuration, so check your config as well:
- CVE-2026-15176: relevant if a
locationblock uses thealiasdirective or the$request_filenamevariable. - CVE-2026-97205: relevant if asynchronous file I/O (AIO) or Server Side Includes (SSI) is enabled.
- CVE-2026-93479: relevant to configurations using unnamed regex captures with the
mapdirective.
If you cannot patch right away, F5’s mitigations as reported are: avoid alias in location blocks and $request_filename for CVE-2026-15176; disable AIO or SSI for CVE-2026-97205; and use named captures instead of unnamed ones, limited to the block containing the regex match, for CVE-2026-93479.
Sources
- F5 security advisory K000162416 (linked from BleepingComputer; the page is JavaScript-rendered)
- F5 security advisory K000162607
- F5 security advisory K000162608
- BleepingComputer: F5 releases out-of-band patches for critical NGINX vulnerabilities