F5 Issues Emergency NGINX Fixes for Three Critical Memory-Safety Vulnerabilities
Vulnerability Disclosure · 9 sources · Updated 9d ago · First seen Oct 22, 2026
F5 released out-of-band patches for NGINX vulnerabilities, including three memory-safety flaws rated 9.2 under CVSS v4.0: CVE-2026-15176, CVE-2026-93479 and CVE-2026-97205. Under specific configurations, the flaws can crash worker processes, cause denial of service and potentially enable remote code execution if Address Space Layout Randomization (ASLR) is disabled or bypassed. CVE-2026-15176 involves alias/rewrite processing and request-filename references; CVE-2026-93479 involves regex-map captures or certain non-cacheable variables; CVE-2026-97205 is a use-after-free involving asynchronous file I/O and Server Side Includes. The reported product scope includes NGINX Plus, NGINX Open Source, Ingress Controller, Gateway Fabric and Instance Manager. F5 reported no evidence of active exploitation at patch release. Amazon Linux rates the three flaws Medium under its CVSS v3 assessments, reflecting differences in scoring methodology and assessed impact.
The broader update addresses 11 vulnerabilities, according to Uganda CERT. Related advisories also describe CVE-2026-97629, which can permit nondeterministic TLS session forgery and bypass client-certificate verification under particular session-cache configurations, and a separate configuration-dependent HTTP/3 proxied-request body-injection flaw. The AWS advisories identify data-plane exposure, not control-plane exposure. Administrators should inventory direct and embedded NGINX deployments and prioritize applicable vendor updates; an oss-sec notice identifies NGINX Open Source 1.30.6 and 1.31.7 as fixed release thresholds. Amazon Linux lists fixes released October 24 for its supported NGINX packages on Amazon Linux 2 and 2023, while its Nginx1.12 Extra has no fix planned and Amazon Linux 2027 Preview fixes remain pending. Until patched, apply vendor configuration-specific mitigations, verify ASLR, restrict worker privileges, segment exposed systems and monitor repeated worker crashes or restarts.
