F5 Patches Three Critical NGINX Vulnerabilities That Could Enable Remote Code Execution

F5 has released out-of-band security updates to address three critical vulnerabilities in NGINX web server components. The flaws could allow an unprivileged remote attacker to cause a denial-of-service (DoS) condition or execute code on systems with non-default configurations.

Three critical NGINX vulnerabilities

The vulnerabilities affect the ngx_http_v3_module and the NGINX map directive:

• CVE-2026-15176 — a vulnerability in ngx_http_v3_module
• CVE-2026-97205 — a vulnerability in ngx_http_v3_module
• CVE-2026-93479 — a vulnerability involving the NGINX map directive

A successful exploit involving the first two vulnerabilities could trigger a heap-based buffer overflow or use-after-free in the NGINX worker process, causing it to crash or restart. An attacker may also be able to execute code on systems where Address Space Layout Randomization (ASLR) is disabled or where ASLR can be bypassed.

NGINX products affected

F5 has released security patches for multiple affected NGINX products, including:

• NGINX Plus
• NGINX Open Source
• NGINX Ingress Controller
• NGINX Gateway Fabric
• NGINX Instance Manager

Security teams and administrators should install the available updates as soon as possible. Organizations that cannot immediately apply the patches can use the following mitigations:

• CVE-2026-15176: Do not use the alias directive in the location block or the $request_filename variable.
• CVE-2026-97205: Disable asynchronous file I/O (AIO) or server-side includes (SSI).
• CVE-2026-93479: Use named captures instead of unnamed captures, and restrict the directive’s use to blocks containing regular expression matches.

F5 vulnerabilities have been targeted in previous attacks

F5 has not reported that these NGINX vulnerabilities are being exploited in the wild. However, cybercrime and nation-state threat groups have frequently exploited vulnerabilities in F5 products in recent years.

Attackers have previously used F5 security flaws to infiltrate corporate networks, map internal servers, hijack devices, deploy data-erasure malware, and steal sensitive documents from victims around the world.

Since November 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has listed eight F5 vulnerabilities in its Known Exploited Vulnerabilities Catalog. Four of those vulnerabilities have also been used in ransomware attacks.

In October 2025, F5 disclosed that state-sponsored attackers had infiltrated its systems in August 2025 and stolen source code and information about undisclosed BIG-IP security vulnerabilities.

F5 is a Fortune 500 technology company that provides cybersecurity, application delivery networking (ADN), and other services to more than 23,000 customers, including 80% of Fortune 500 companies and 48 Fortune 50 companies.

The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.

The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.

Get the report