internet-facing-service-vulnerabilitywidely-deployed-product-advisoryopen-source-dependency-vulnerability

F5 Discloses Three Vulnerabilities Affecting Multiple NGINX Products

Vulnerability Disclosure · 3 sources · Updated 8d ago · First seen Oct 15, 2026

F5 disclosed three vulnerabilities affecting its NGINX product portfolio, prompting advisories from the Canadian Centre for Cyber Security and Guyana National CIRT. The notices identify CVE-2026-101019 in ngx_http_js_module, CVE-2026-104939 in NGINX Ingress Controller, and CVE-2026-15176 in ngx_http_core_module. Affected products include NGINX Gateway Fabric, Ingress Controller, JavaScript, Open Source, Plus, Instance Manager, F5 WAF for NGINX, and F5 DoS for NGINX.

Both national cybersecurity authorities recommend reviewing the linked vendor advisories and applying applicable updates as they become available. Organizations operating these products should check F5’s guidance to determine affected versions and required remediation. The supplied notices do not specify severity scores, technical impacts, or exploitation status, so they do not establish whether any of the vulnerabilities are being actively exploited.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

2 events · Oct 14, 2026 – Oct 15, 2026

Oct 15, 20269d ago
Canadian Cyber Centre issues F5 security advisory AV26-1049
The Canadian Centre for Cyber Security issued advisory AV26-1049 detailing affected F5 NGINX products and versions and linking to the vendor advisories for the three vulnerabilities. It urged users and administrators to review the advisories and apply necessary updates as they become available.
F5 security advisory (AV26-1049) - Malware News - Malware Analysis, News and Indicators
Oct 14, 202610d ago
F5 publishes advisory covering vulnerabilities across NGINX products
F5 published a security advisory identifying CVE-2026-101019 in ngx_http_js_module, CVE-2026-104939 in NGINX Ingress Controller, and CVE-2026-15176 in ngx_http_core_module. Affected products include NGINX Gateway Fabric, Ingress Controller, JavaScript, Open Source, Plus, Instance Manager, F5 WAF for NGINX, and F5 DoS for NGINX.
CIRT.GY | F5 Security Advisory (October 15th, 2026)

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

3 linked

External Authentication Bypass in F5 NGINX Ingress Controller (CVE-2026-104939)Heap buffer overflow in NGINX alias/rewrite request filename mapping (CVE-2026-15176)Signed-XML validation bypass in NGINX JavaScript (CVE-2026-101019)

Affected products

6 linked

Nginx Instance ManagerNginx Ingress ControllerNginx PlusF5 Waf For NginxNginx Gateway FabricNginx

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

3 references tracked. Mallory keeps watching after this page renders.

Malware NewsNews · Oct 15, 2026

F5 security advisory (AV26-1049) - Malware News - Malware Analysis, News and IndicatorsOpen source ↗

Ca CcsNews · Oct 15, 2026

F5 security advisory (AV26-1049) - Canadian Centre for Cyber SecurityOpen source ↗

Cirt GyNews · Oct 15, 2026

CIRT.GY | F5 Security Advisory (October 15th, 2026)Open source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

F5 Discloses Three Vulnerabilities Affecting Multiple NGINX Products

How this story unfolded

Canadian Cyber Centre issues F5 security advisory AV26-1049

F5 publishes advisory covering vulnerabilities across NGINX products

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

Critical NGINX Flaws Expose HTTP/2, gRPC, HTTP/3 and Gateway Fabric Deployments

Critical RCE Flaw in NGINX and F5 NGINX Products Prompts Urgent Patching

F5 Issues Out-of-Band Fixes for BIG-IP and NGINX Product Vulnerabilities

F5 Discloses Three Vulnerabilities Affecting Multiple NGINX Products

How this story unfolded

Canadian Cyber Centre issues F5 security advisory AV26-1049

F5 publishes advisory covering vulnerabilities across NGINX products

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

Critical NGINX Flaws Expose HTTP/2, gRPC, HTTP/3 and Gateway Fabric Deployments

Critical RCE Flaw in NGINX and F5 NGINX Products Prompts Urgent Patching

F5 Issues Out-of-Band Fixes for BIG-IP and NGINX Product Vulnerabilities