Critical NGINX Flaws Prompt Emergency F5 Security Updates

F5 has released emergency security updates to address critical NGINX flaws that could allow remote attackers to crash vulnerable servers or execute code. The three most serious vulnerabilities affect systems running specific, non-default configurations.

Attackers do not need existing privileges to exploit these weaknesses. However, code execution depends on additional conditions, including whether they can overcome memory protection measures.

Three Vulnerabilities Affect Request Processing

Two critical vulnerabilities, CVE-2026-15176 and CVE-2026-97205, affect the ngx_http_v3_module. The third, CVE-2026-93479, involves the NGINX map directive.

Successful exploitation can trigger a heap-based buffer overflow or a use-after-free condition in an NGINX worker process. As a result, the process could crash or restart, disrupting service.

The potential impact also extends beyond downtime. According to F5, attackers may achieve code execution when a system has Address Space Layout Randomization disabled or they can bypass it.

ASLR makes memory locations less predictable, which helps obstruct exploitation. Therefore, the presence of a vulnerable configuration does not automatically mean an attacker can execute code.

Updates Cover Several NGINX Products

F5 issued patches for affected products across its NGINX portfolio. These include NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric and NGINX Instance Manager.

However, exposure depends on the product and its configuration. The critical vulnerabilities concern particular settings rather than every standard NGINX installation.

Administrators should review the relevant product advisories to establish which updates apply to their deployments. They should also examine enabled features and configuration directives when assessing exposure.

Temporary Mitigations Address Specific Configurations

For teams that cannot immediately install the updates, F5 outlined configuration changes to reduce exposure to the critical NGINX flaws.

For CVE-2026-15176, the mitigation involves avoiding the alias directive within a location block and the $request_filename variable.

Meanwhile, administrators can mitigate CVE-2026-97205 by disabling asynchronous file I/O, known as AIO, or Server Side Includes, known as SSI.

For CVE-2026-93479, F5 recommends replacing unnamed captures with named captures. Administrators should also limit their use to the block containing the regular expression match.

These measures address specific vulnerable configurations. However, teams should still plan to install the applicable security updates.

No Active Exploitation Reported in the Disclosure

At the time of the report, F5 had not identified these vulnerabilities as actively exploited. Nevertheless, previous attacks against F5 products provide a reason to prioritize the updates.

Both cybercriminal groups and state-sponsored attackers have exploited earlier F5 weaknesses. Those incidents have involved corporate network breaches, device takeovers and sensitive data theft.

Since November 2021, CISA has added eight F5 vulnerabilities to its Known Exploited Vulnerabilities catalog. Four have also featured in ransomware attacks.

Separately, F5 disclosed an intrusion in October 2025 involving state-sponsored attackers who breached its systems that August. The attackers stole source code and information about undisclosed BIG-IP vulnerabilities.

That earlier incident does not establish a connection to the newly disclosed NGINX flaws. For affected organizations, the immediate priority remains identifying vulnerable configurations and applying the appropriate fixes.