F5 Out-of-Band Patches Fix Three High-Sev NGINX Flaws
F5 patched three CVSS 8.1 flaws in NGINX Plus and Open Source on October 14, covering HTTP/3, AIO+SSI processing, and map directive handling. No exploitation confirmed.
Morgan "airgap" ReyesThree CVSS 8.1 vulnerabilities in NGINX Plus and Open Source. Out-of-band patches landed October 14. No exploitation confirmed in the wild.
All three are data-plane issues. No control-plane exposure. An unauthenticated attacker can reach each one, but all three require conditions the attacker does not fully control. Code execution is conditional on ASLR being disabled or bypassable; otherwise the worst-case outcome is a worker process crash and restart.
The three flaws
CVE-2026-15176 is a heap buffer overflow triggered via the alias directive. Specifically: a location block using alias together with rewrite and a $request_filename variable reference, or that same variable in an access log format directive. Crafted HTTP requests can overflow a worker heap buffer. Workaround: remove $request_filename from any location that also uses alias, and from access log format strings.
CVE-2026-97205 is a use-after-free in ngx_http_core_module. Triggered when asynchronous file I/O (AIO) is enabled and a Server Side Includes (SSI) page processes include virtual directives. Result: memory corruption or worker crash. Workaround: disable AIO or disable SSI.
CVE-2026-93479 is a second heap overflow, in map directive processing. Affects configurations where regex matching uses unnamed captures and those captures are referenced in a root directive or access log format before the map output variable appears, or where a non-cacheable variable appears in certain string expressions. Workaround: replace unnamed regex captures with named captures.
Affected products
F5 released patches for: NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager. Specific patched version numbers were not disclosed in the public summary reviewed; F5’s security advisory has current patch guidance.
What to do
Apply the available patches. If immediate patching is not possible, the per-flaw configuration workarounds listed above neutralize each attack path individually. Neither requires taking NGINX offline. CISA has not added any of the three to the Known Exploited Vulnerabilities catalog as of this writing.
Source: BleepingComputer. See also F5 BIG-IP APM RCE Zero-Day Under Attack, Next.js Out-of-Band Update Fixes Two Critical RCEs.
Found this useful? Share it.
