F5 rushes out emergency NGINX patches for three critical flaws

F5 is once again disclosing cybersecurity flaws in its core offerings. The app delivery and security provider has released out-of-band (OOB) security patches that address multiple flaws in NGINX, its high-performance software that controls digital traffic for websites. These include three critical-severity flaws that could allow attackers to crash systems, execute code, and launch denial of service (DoS) attacks. OOB security patches are emergency software updates released outside of normal maintenance cycles. CVE-2026-15176, CVE-2026-97205, and CVE-2026-93479 are rated 9.2 in severity in the latest version (4.0) of the Common Vulnerability Scoring System (CVSS). Impacted software products include NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager. While F5 says it hasn’t discovered evidence that these issues are being exploited in the wild, it advises customers to install or upgrade to fixed versions. Analysts agree. “NGINX is the front door: Reverse proxy, load balancer, and Kubernetes ingress,” said Frank Dickson of Dickson Research, noting that transport layer security (TLS) usually terminates in NGINX. “Code execution on that box means seeing passwords, session cookies, and API tokens in the clear, plus the private keys that make it all trustworthy.” Allowing attackers to crash systems CVE-2026-15176 and CVE-2026-97205 are ngx_http_core_module vulnerabilities in F5’s NGINX, which could cause a heap buffer overflow in the server’s worker process. This type of memory corruption could lead to a system crashing or restarting, thus giving attackers access. Threat actors could also execute code on systems where Address Space Layout Randomization (ASLR), a technique intended to prevent exploitation by randomly arranging memory locations when an app starts, is disabled, or bypass ASLR altogether. The flaws could allow attackers to launch DoS attacks to make the server inaccessible to legitimate users, F5 explained. CVE-2026-93479 is similar, in that it is a map directive flaw that could allow attackers to send crafted HTTP requests to cause a heap buffer overflow; they can also execute code when ASLR is disabled, or bypass it. These vulnerabilities follow F5’s disclosure of CVE-2026-42530 in June. The flaw in ngx_http_v3_module in NGINX Open Source could also potentially allow remote attackers to cause DoS or trigger code execution. Customers can mitigate CVE-2026-15176 by avoiding use of the $request_filename variable and the alias directive in a location block, F5 said, and CVE-2026-97205 can be mitigated by disabling asynchronous file I/O (AIO) and Server Side Includes (SSI). Meanwhile, F5 advised mitigating CVE-2026-93479 by avoiding unnamed captures and instead using named captures and limiting their usage to the block with the regex match. But, noted Seva Ioussoufovitch, senior research analyst at Infotech, “since NGINX is used across a wide swath of systems, this may increase the risk of service availability loss for many enterprises.” The latest in a series of cybersecurity issues While these three vulnerabilities are not known to be exploited in the wild, F5 has repeatedly borne the brunt of cyberattacks in recent years, which is troubling because the cybersecurity and app delivery networking (ADN) company serves tens of thousands of customers, including 80% of the Fortune 500, analysts noted. Threat actors have repeatedly targeted flaws in its systems and products to map internal servers, hijack devices, breach systems, steal sensitive documents, and deploy data-wiping malware. Over the last five years, the US Cybersecurity and Infrastructure Security Agency (CISA) has flagged eight actively-exploited F5 vulnerabilities; four of these have been targeted in ransomware attacks. For instance, a 2025 nation-state breach and CISA’s Emergency Directive 26-01 centered on F5’s BIG-IP, and F5 said at the time that NGINX source code was not accessed. But, Dickson noted, NGINX’s own “warning shot” came in May when CVE-2026-42945, a rewrite module overflow nicknamed NGINX Rift, arrived with a public remote code execution proof of concept. “This week’s alias and rewrite flaw lives in the same neighborhood,” he said, pointing out, “attackers read changelogs, too.” Mitigation Ioussoufovitch noted that the flaws are configuration-dependent, so enterprises should begin with an audit of current NGINX configurations to help risk-prioritize this patch. F5 also said that the risk of remote code execution (RCE) notably increases when ASLR is disabled, so users should double-check that ASLR and other typical OS-level protections are proactively enabled to at least limit the exploitation risk from similar types of attack. Enterprises need to ensure they have a clear inventory of which of their systems are running NGINX, including those where it is embedded in other products. This is critical to supporting configuration audits, segmentation efforts, and NGINX worker monitoring efforts, which can indicate that attackers “are poking at these types of vulnerabilities,” Ioussoufovitch said. “NGINX has already had multiple security releases this year, and I expect the trend to continue well into the future,” he noted. Dickson agreed that inventorying is the first step. NGINX “hides inside” ingress controllers, appliances, and container images. Many teams get NGINX from their Linux distribution, not nginx.org, and Amazon Linux still lists the AIO fix as pending. “A fix on the vendor’s site does not patch your servers,” he cautioned. As well as performing the inventory, enterprises should search their configurations for aliases paired with rewrite, AIO paired with SSI, and map blocks using unnamed regex captures. If an organization cannot patch today, the workarounds are simple, Dickson said: Disable AIO or stop serving SSI pages; switch map to named captures; confirm ASLR is on, run workers unprivileged; and segment the front door so it cannot reach the crown jewels. And, watch for worker processes that keep restarting. “These flaws need the right configuration to bite, and that is the good news,” Dickson said. “The bad news is that many organizations may not know what their NGINX configurations actually say.”