F5 releases emergency patches for critical NGINX flaws

F5 released out‑of‑band patches to fix three critical NGINX vulnerabilities, identified as CVE‑2026‑15176, CVE‑2026‑97205, and CVE‑2026‑93479. The patches address flaws in the ngx_http_v3_module and the NGINX map directive that could allow attackers to crash servers or run code. F5’s announcement came just hours after the bugs were disclosed, highlighting the urgency of the fixes.

What the flaws allow

The vulnerabilities are rated 9.2 on the Common Vulnerability Scoring System and can lead to denial‑of‑service attacks or remote code execution when Address Space Layout Randomization is disabled or bypassed. The affected products include NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager. No evidence of exploitation in the wild has been reported, but the flaws could be dangerous if activated.

F5 recommends installing the patched versions or applying configuration workarounds. For CVE‑2026‑15176, administrators should avoid using the $request_filename variable and the alias directive in location blocks. CVE‑2026‑97205 can be mitigated by disabling asynchronous file I/O or Server Side Includes, while CVE‑2026‑93479 should be addressed by using named captures instead of unnamed ones and limiting their use to the regex block.

This release follows a history of F5 vulnerabilities that have been targeted by cybercriminals and nation‑state actors, with the U.S. Cybersecurity and Infrastructure Security Agency flagging several actively exploited flaws in recent years. F5’s own 2025 breach involved theft of source code and undisclosed security weaknesses, underscoring the company’s importance to many Fortune 500 clients.

F5 recommends that security teams inventory all NGINX deployments, verify that Address Space Layout Randomization is enabled, run worker processes with limited privileges, and segment the front door to protect critical assets, and that if patches cannot be applied immediately, configuration mitigations can reduce risk and help detect abnormal worker restarts.