F5 releases out-of-band patches for critical NGINX vulnerabilities

F5 addressed three critical vulnerabilities in NGINX components: CVE-2026-15176 and CVE-2026-97205 in the ngx_http_v3_module, and CVE-2026-93479 in the map directive. These flaws enable remote attackers to trigger heap-based buffer overflows or use-after-free bugs in the NGINX worker process, causing denial-of-service or potential remote code execution on systems with non-default configurations and ASLR disabled or bypassed. F5 released out-of-band patches for multiple NGINX products including NGINX Plus, Open Source, Ingress Controller, Gateway Fabric, and Instance Manager. Mitigations include avoiding the 'alias' directive or $request_filename variable, disabling asynchronous file I/O or Server Side Includes, and using named captures in regex blocks. While no exploitation in the wild has been observed, F5 products have historically been targeted by cybercrime and nation-state actors.

Successful exploitation can cause denial-of-service via crashes or restarts of the NGINX worker process due to heap-based buffer overflow or use-after-free vulnerabilities. Additionally, remote code execution is possible on systems where ASLR is disabled or can be bypassed, potentially allowing attackers to execute arbitrary code without privileges. This affects multiple F5 NGINX products and could lead to system compromise or service disruption.

F5 has released official out-of-band patches for all affected NGINX products. Security teams are advised to apply these patches promptly. For those unable to patch immediately, mitigations include: for CVE-2026-15176, avoid using the 'alias' directive in location blocks or the $request_filename variable; for CVE-2026-97205, disable asynchronous file I/O (AIO) or Server Side Includes (SSI); for CVE-2026-93479, use named captures instead of unnamed captures and limit their use to the regex match block. No active exploitation has been reported, but timely patching is recommended.