F5 Patches Three NGINX Flaws Out of Band

F5 shipped out-of-band patches for NGINX on October 19, addressing three vulnerabilities rated CVSS 8.1 (high) by NVD. None have confirmed exploitation in the wild, but the out-of-band timing signals F5 considered these too time-sensitive to hold for a normal release cycle.

Two of the three flaws are in ngx_http_v3_module. The third is in the map directive.

HTTP/3 module: two flaws, two memory-safety classes

CVE-2026-15176 is a heap-based buffer overflow in ngx_http_v3_module. A remote, unauthenticated attacker can use it to trigger a denial-of-service condition or, in certain configurations, achieve code execution. F5’s configuration workaround: avoid the alias directive inside location blocks and avoid using $request_filename in those contexts.

CVE-2026-97205 is a use-after-free in the same module. It can crash NGINX worker processes and enable code execution when ASLR is disabled on the underlying system. Configurations running asynchronous file I/O (AIO) or Server Side Includes (SSI) carry higher exposure here. F5’s workaround: disable AIO and SSI until the patch is applied.

Map directive

CVE-2026-93479 sits in the map directive rather than the HTTP/3 stack. It involves use-after-free and buffer overflow conditions tied to unnamed regex captures in map blocks. The map directive is used broadly in production NGINX configurations for routing and rewrite logic, so the affected surface is not small. F5’s workaround: switch to named captures in any affected map configuration.

Affected products

All five of F5’s primary NGINX products are in scope: NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager. Exact version ranges are in F5’s security advisories.

Why the HTTP/3 module is getting attention

Two separate memory-safety issues in the same module is a pattern worth watching. HTTP/3 support is relatively new in NGINX, and new protocol implementations tend to accumulate these kinds of issues before they stabilize under sustained scrutiny. The pair here may reflect an internal audit, a coordinated researcher report, or simply the consequence of increased production deployment bringing edge cases to light.

The map-directive flaw is unrelated, and the argument for patching it applies on its own merits.

For environments running HTTP/3-enabled NGINX exposed to the internet, these patches move up the priority queue. The CVSS score is 8.1, not in the critical band, and the configuration workarounds F5 documents are viable for short-term exposure reduction. Patching is the only complete fix.

For broader context on out-of-band patch releases in web infrastructure, see Next.js Out-of-Band Update Fixes Two Critical RCEs from earlier this week and BIND 9 Patches 14 Flaws Including Unauthenticated DoH Crash.