F5 has shipped out-of-band security patches for eleven NGINX vulnerabilities, and three of them are rated critical with a CVSSv4 score of 9.2. Out-of-band means the fixes did not wait for a regular release cycle, which tells you how F5’s threat model team views these. If you run NGINX anywhere in your stack, and almost everyone does, this one is worth an hour of your week.
The three critical issues are CVE-2026-15176, CVE-2026-93479, and CVE-2026-97205. All three can be triggered by an unauthenticated remote attacker. All three are data-plane only, so there is no control plane exposure, and all three share the same uncomfortable caveat: code execution requires ASLR to be disabled or bypassed. Without that, the realistic outcome is a worker process crash and restart, which is a denial of service rather than a breach. That distinction matters for how you prioritize, but it is a thin line to stand on for internet-facing proxies.
What the three flaws actually are
CVE-2026-15176 is a heap buffer overflow that needs a specific but very recognizable configuration: a location block using the alias directive together with rewrite, plus a set or return directive referencing $request_filename. The same trigger works if $request_filename appears in an access log format. That combination is not exotic. Plenty of teams alias static directories and log request filenames.
CVE-2026-93479 is another heap overflow, this one in string expression evaluation. The trigger is a map directive using regex matching where the root directive or an access log format references the map’s regex capture variables before the map output variable. If you cannot tell at a glance whether your configs do this, that is exactly the point. The nginx.org security advisory list rates it major for open source and shows it affecting 1.31.2 through 1.31.6 and 1.30.0 through 1.30.5.
CVE-2026-97205 is a use-after-free in the core HTTP module. It requires asynchronous file I/O enabled in certain configurations, processing an SSI page with include virtual commands. Older setups that leaned on AIO for static file performance should take note; that pattern was common advice for a long time.
Am I affected?
Version-wise, the fixed releases are NGINX Open Source 1.31.7 and 1.30.6, released October 14, 2026, and NGINX Plus 37.1.0.1 and 37.0.5.1. The NGINX Plus branch affected runs from R33 through R37, so a fairly wide window of current deployments is in scope.
The sneaky part is that raw nginx.conf is not the only place this lives. The advisory covers NGINX Ingress Controller, NGINX Gateway Fabric, NGINX Instance Manager, F5 WAF for NGINX, NGINX App Protect, and the DoS products. A Kubernetes team that never hand-edits an NGINX config can still be running a vulnerable ingress controller version. Your inventory needs to include the bundled products, not just the web server.
Config-dependent exposure cuts the other way too. A default NGINX install may not be exploitable at all, because all three triggers require specific directives. F5’s own advisory K000163408 lays out the conditions. A grep across your config management repo for alias-plus-$request_filename, regex map captures, and AIO-plus-SSI will tell you whether you need to panic or just patch calmly at the next window.
Patching the Kubernetes layer
For ingress controllers the upgrade path differs from a package bump. NGINX Ingress Controller and Gateway Fabric ship the affected code inside their container images, so the fix arrives as a new image tag and a rolling redeploy of the controller pods. That is usually routine, but check the release notes for breaking changes between controller minor versions before jumping several of them at once. Instance Manager and the App Protect products carry their own version matrices, so a fleet audit that only counts nginx binaries will under-report exposure. In the meantime, watch worker process restart counts. The crash-and-restart behavior these flaws produce is noisy enough to spot in standard logs, and a spike in restarts preceded by malformed requests on an unpatched box deserves investigation.
If you cannot patch yet
The mitigations map directly to the triggers. Stop using alias with $request_filename, or restructure the location. Disable AIO or SSI if you are running that combination. Prefer named captures in map directives instead of positional ones. None of these are free rewrites, but all are smaller than the cost of explaining an internet-facing NGINX compromise.
It is also worth being honest about why an out-of-band release with no confirmed exploitation still deserves urgency. F5 has not flagged these as exploited in the wild. But CISA has flagged eight F5 vulnerabilities as actively exploited since 2021, several in ransomware campaigns, and F5 disclosed a state-sponsored breach of its own systems in October 2025 that stole source code and details of undisclosed BIG-IP flaws. Adversaries pay attention to this vendor’s products. When F5 jumps its own release cadence, the reasonable read is that they would rather be early than sorry.
So: check your versions, grep your configs, and prioritize the boxes that terminate traffic from the internet. The worker-crash outcome is annoying. The ASLR-bypass outcome is a very bad week.