F5 patches three critical NGINX vulnerabilities

F5 has released out-of-band security patches for multiple vulnerabilities in its NGINX web server products. Three are rated critical and could let remote attackers without privileges cause denial-of-service (DoS) attacks or execute code on systems with non-default configurations.

Two flaws affect the ngx_http_v3_module (CVE-2026-15176 and CVE-2026-97205); the third affects the NGINX map directive (CVE-2026-93479). Exploitation can cause a heap-based buffer overflow or use-after-free in an NGINX worker process, leading to a crash or restart. Code execution may be possible when Address Space Layout Randomization (ASLR) is disabled or bypassed.

The patches cover NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager. F5 also described mitigations for administrators who cannot install the updates immediately: avoid certain directives or variables for the first two flaws, disable asynchronous file I/O (AIO) or Server Side Includes (SSI) for CVE-2026-97205, and use named captures instead of unnamed captures for CVE-2026-93479.

F5 has not flagged the vulnerabilities as exploited in the wild. The source reports that since November 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has listed eight F5 vulnerabilities as actively exploited, four of which were also used in ransomware attacks.