F5 ships out-of-band patches for critical NGINX flaws

F5 has released an out-of-band batch of security updates that fix multiple vulnerabilities in the NGINX web server. Three of them are rated critical and could allow an attacker to execute arbitrary code on a vulnerable system.

Where the bugs live

Two of the critical flaws sit in the ngx_http_v3_module (CVE-2026-15176 and CVE-2026-97205); a third affects the map directive (CVE-2026-93479). An unprivileged remote attacker can exploit them, but only against systems running non-default configurations.

A successful attack triggers a heap-based buffer overflow or a use-after-free in the NGINX worker process. In most cases that means a crash or a restart. But F5 warns that where ASLR is disabled, or where an attacker can bypass it, code execution becomes possible.

What to update

Patches cover a broad range of products: NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager.

For teams that can't patch right away, F5 offers workarounds. CVE-2026-15176 can be mitigated by avoiding the alias directive inside a location block and the $request_filename variable. For CVE-2026-97205, disable asynchronous file I/O (AIO) or Server Side Includes (SSI). CVE-2026-93479 can be blunted by using named captures instead of unnamed ones and limiting them to the block where the regex match occurs.

Why it matters

F5 has not flagged any of these issues as exploited in the wild so far. But flaws in the company's products have been a recurring target for both cybercriminals and nation-state groups in recent years — used to breach corporate networks, map internal servers, hijack devices, deploy data-wiping malware, and steal sensitive documents worldwide.

Since November 2021, the U.S. agency CISA has flagged eight F5 vulnerabilities as actively exploited, four of them also abused in ransomware attacks. A year ago, in October 2025, F5 disclosed that state-sponsored actors had breached its systems in August 2025 and stolen source code along with details of undisclosed BIG-IP vulnerabilities.

F5 is a Fortune 500 company serving more than 23,000 customers, including 80% of the Fortune Global 500 and 48 of the Fortune 50.

Source: Bleeping Computer