F5 releases emergency patches for critical NGINX flaws

F5 announced today that it has issued out‑of‑band patches for three critical‑severity flaws in the NGINX web server. The vulnerabilities affect several NGINX products, including the open source edition and the commercial Plus version, and could let remote attackers execute code or cause denial‑of‑service attacks.

The vulnerabilities and how they work

According to BleepingComputer, the three critical issues are tracked as CVE‑2026‑15176, CVE‑2026‑97205, and CVE‑2026‑93479. Two of them live in the ngx_http_v3_module, while the third is in the NGINX map directive. Exploitation requires no privileged access and targets systems that use non‑default settings. Successful attacks trigger a heap‑based buffer overflow or a use‑after‑free condition in the worker process, which can crash the server or force a restart. The report notes that attackers may also be able to "execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR." While there is no public evidence that these flaws have been used in the wild, the history of F5 products shows that both cybercrime groups and nation‑state actors have previously leveraged similar weaknesses.

Why the flaws matter to small businesses and nonprofits

Many small organizations run web services on NGINX because it is free, lightweight, and widely supported. The vulnerabilities affect not only the base NGINX Open Source package but also F5‑branded offerings such as NGINX Plus, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager. If an attacker gains the ability to run arbitrary code on a web server, they can install ransomware, steal data, or use the compromised host to launch attacks against other parts of the network. Even a denial‑of‑service event can disrupt public‑facing services, leading to loss of reputation and revenue. For organizations that rely on a single web server for online forms, donation pages, or internal portals, the risk is especially acute.

Immediate mitigation and patching steps

If you can apply the patches right away, do so. F5 has released updates for all the affected NGINX products, and installing them eliminates the underlying code flaws. For teams that need more time, the advisory provides configuration work‑arounds that reduce exposure:

• CVE‑2026‑15176: Remove the alias directive from any location block and stop using the $request_filename variable.
• CVE‑2026‑97205: Turn off asynchronous file I/O (AIO) and disable Server Side Includes (SSI).
• CVE‑2026‑93479: Replace unnamed captures in regular expressions with named captures, and restrict the use of captures to the block that contains the regex match.

These steps can be applied in the NGINX configuration files and reloaded without a full restart. However, they are not substitutes for the official patches; they merely lower the chance of a successful exploit. After any change, test your site to confirm that functionality remains intact.

How to verify your environment is protected

1. Check your NGINX version, Identify whether you are running an affected product (Open Source, Plus, Ingress Controller, etc.) and note the exact version number.
2. Confirm patch installation, Review the package manager logs or F5 release notes to ensure the out‑of‑band update was applied.
3. Audit configuration, Scan your nginx.conf and included files for the directives and patterns mentioned above. Remove or adjust them as needed.
4. Run a vulnerability scan, Use a reputable external scanner or the free external scan linked from our site to see if the known CVEs are still reported.
5. Monitor logs, Look for unusual worker process crashes or restarts, which could indicate an attempted exploitation.

Looking ahead

The release of emergency patches highlights the importance of keeping web‑server software up to date, especially for tools that are widely deployed in low‑resource environments. While F5 has not flagged these flaws as actively exploited, the company’s past experience shows that once a vulnerability is publicly disclosed, threat actors often move quickly. Maintaining a regular patch cadence, enabling multi‑factor authentication for admin accounts, and limiting exposure of non‑default configurations are practical ways to reduce overall risk. For organizations that depend on NGINX, consider a routine review of custom directives and third‑party modules, as these are common vectors for new vulnerabilities.

If you are unsure whether your site is still vulnerable, start with a free external scan on our security page.