CVE-2026-104939 is a vulnerability in F5 NGINX Ingress Controller versions 5.6.0 up to but not including 5.7.0. It involves improper handling of HTTP responses from an OAuth Identity Provider (IdP) when implementing an externalAuth policy, potentially allowing unauthenticated access to protected paths. This issue affects only the data plane and does not expose the control plane. The vulnerability has a high severity with a CVSS score of 7.5.
NGINX JavaScript (njs) contains a vulnerability in its XML module where entity-backed XML attributes are inconsistently exposed during canonicalization. This inconsistency can cause certain XML attributes to appear missing or truncated while signature verification still succeeds. This affects signed-XML consumers such as nginx-saml, potentially allowing replay attacks or acceptance of responses outside their intended context. The vulnerability does not allow signature or identity forgery and has no direct availability impact. It is a data plane issue without control plane exposure.
F5 NGINX JavaScript (njs) contains a memory leak vulnerability in its built-in njs engine where a libxml2 parser context is not released when xml.parse() fails. This can lead to unbounded memory growth in long-lived NGINX worker processes, potentially causing worker termination or denial of service. The issue affects versions from 0.7.10 up to but not including 1.0.2. The vulnerability is exploitable remotely without authentication and does not impact confidentiality or integrity, only availability. There is no control plane exposure; the issue is limited to the data plane.
CVE-2026-95101 is a medium severity vulnerability in F5 NGINX Plus and NGINX Open Source affecting the ngx_http_v3_module. When HTTP/3 is used with the proxy_request_buffering directive enabled, an unauthenticated attacker may inject data into the proxied request. This is a data plane issue without control plane exposure. The vulnerability affects multiple versions of NGINX Plus and Open Source as specified. No known exploits are reported in the wild. Versions that have reached End of Technical Support are not evaluated.
CVE-2026-94197 is an authentication and authorization bypass vulnerability in F5 NGINX Kubernetes Ingress Controller when using the ExternalAuth policy or Ingress external authentication. Unsanitized client-supplied routing and method headers are forwarded into internal authentication subrequests, allowing unauthenticated remote attackers to spoof request attributes. This can lead to unauthorized access to protected paths. The issue affects data plane operations only and does not expose the control plane. The vulnerability affects versions from 5.5.0 up to but not including 5.7.0. No patch information is provided. The CVSS score is 7.5 (high severity).
CVE-2026-96615 is an authentication bypass vulnerability in F5 NGINX Gateway Fabric versions 2.0.0 up to but not including 2.8.0. It occurs when the product is configured with Gateway Custom Resource Definition (CRD) and uses an authenticated gRPC connection with the NGINX Agent. An authenticated attacker with access to a service account in one namespace can impersonate the NGINX Agent's gRPC connection to read TLS private keys of Gateway deployments in other namespaces. This vulnerability affects the control plane only and does not expose the data plane.
CVE-2026-91184 is a vulnerability in F5 NGINX Gateway Fabric affecting versions 2.4.0 up to but not including 2.8.0. It involves improper handling of the spec.basic.realm and spec.jwt.realm fields in the AuthenticationFilter CRD, allowing an authenticated attacker to inject arbitrary NGINX directives into the shared data-plane configuration. This can lead to unauthorized access to co-located tenants' secrets, SSRF attacks, and hijacking of tenant routes. The issue affects the control plane only, with no direct data plane exposure.
CVE-2026-97205 is a Use-After-Free vulnerability in the ngx_http_core_module of NGINX Plus and NGINX Open Source. It occurs when asynchronous file I/O (AIO) is enabled and a Server Side Includes (SSI) page with "include virtual" commands is processed. This can cause memory corruption, worker process crashes, or potentially remote code execution on systems without ASLR or where ASLR is bypassed. The vulnerability affects specific versions of NGINX Plus and Open Source as listed. It is a high severity issue with a CVSS score of 8.1. There is no control plane exposure; the issue is limited to the data plane. No patch links are provided in the data, and the vendor advisory status is not explicitly stated.
A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.
Impact:
This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2026-97629 is a vulnerability in F5 NGINX Plus and NGINX Open Source when configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key file directive. This flaw allows a remote unauthenticated attacker to forge client SSL sessions unpredictably, potentially bypassing client certificate verification. The issue affects multiple versions of NGINX Plus and NGINX Open Source. It is a data plane vulnerability with no control plane exposure. The CVSS score is 6.5, indicating medium severity.
CVE-2026-15176 is a heap-based buffer overflow vulnerability in F5 NGINX Plus and NGINX Open Source. It occurs when a location is configured using the alias directive combined with rewrite and a set or return directive referencing the $request_filename variable, or when $request_filename is used in an access log format directive. An unauthenticated attacker can exploit this by sending crafted HTTP requests, potentially causing the NGINX worker process to restart or enabling code execution if ASLR is disabled or bypassed. This vulnerability affects multiple versions of NGINX Plus and Open Source as specified. It is a data plane issue with no control plane exposure.
When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization server profiles configured) are not affected by this vulnerability.
Impact:
This vulnerability allows an unauthenticated attacker to perform remote code execution. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2026-90439 is a heap-based buffer overflow vulnerability in the ngx_http_v3_module of NGINX Plus and NGINX Open Source when using HTTP/3 with OpenSSL versions up to 3.5.0 under certain configurations. This flaw can cause the NGINX worker process to restart or experience limited data corruption. The issue affects the data plane only and does not expose the control plane. The vulnerability has a medium severity rating with a CVSS score of 6.5.
CVE-2026-78689 is a high-severity vulnerability in the NGINX JavaScript (njs) XML module's namespace prefix list parser. It can be triggered remotely without authentication via the xml.exclusiveC14n() method when an externally controlled XML namespace prefix list is passed. Both the njs and QuickJS engines are affected, causing out-of-bounds writes that lead to worker crashes or memory growth. The vulnerability affects the nginxinc/nginx-saml reference implementation during SAML signature verification, allowing crafted SAML messages to trigger the flaw without requiring a valid signature. Code execution has not been demonstrated but cannot be ruled out. This is a data plane issue causing denial of service through worker restarts or memory exhaustion. Versions from 0.7.10 up to but not including 1.0.1 are affected. No patch information is provided.
CVE-2026-78222 is a high-severity vulnerability in F5 NGINX JavaScript where a malformed HTTP response processed by ngx.fetch() can cause a NULL pointer dereference when trusted JavaScript reads Response.statusText, leading to an NGINX worker crash and denial-of-service. Exploitation requires control or influence over the fetched HTTP response. This issue affects versions from 0.5.1 up to but not including 1.0.1. There is no control plane exposure; the impact is limited to the data plane. No known exploits are reported in the wild. Versions that have reached End of Technical Support are not evaluated.
When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without sanitization. An authenticated attacker with permission to create or modify these annotations may craft values that inject arbitrary NGINX configuration directives.
Impact:
An authenticated attacker granted write access to NGINX Ingress Controller Ingress annotations through the Kubernetes API may be able to inject arbitrary NGINX configuration directives, create or delete files, or disable services. There is no data plane exposure; this is a control plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Description:
When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the Authentication Filter Custom Resource Definition clientID or cookieName fields, or in the clientSecret field of a Secret referenced by an Authentication Filter, are rendered directly into NGINX configuration templates without sanitization or escaping.
Impact:
An authenticated attacker with permission to create or modify these resources may craft values that inject arbitrary NGINX configuration directives. This is a control plane issue; there is no data plane exposure.
Description
NGINX JavaScript (njs) and QuickJS (qjs) engines have a vulnerability when a js_access handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker can exploit this vulnerability by sending a crafted HTTP request that triggers an error condition in the access validation logic. This may cause the js_access phase to fail open, allowing the request to proceed instead of being denied, resulting in an authentication or authorization bypass and unauthorized access to protected resources.
Impact
This vulnerability may allow remote attackers to bypass js_access controls. There is no control plane exposure; this is a data plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
BIG-IP has a vulnerability where an authenticated user of any role may be able to create administrative user accounts through an undisclosed request to Traffic Management User Interface (TMUI).
Impact:
This vulnerability may allow an authenticated attacker with network access to the BIG-IP management interface to escalate privileges by creating administrative accounts on the BIG-IP system. There is no data plane exposure; this is a control plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages
Impact:
An attacker may trick authenticated BIG-IP users
into accessing malicious links and reflect a spoofed error message in
the victim's BIG-IP Configuration utility web browser session. This is a
control plane issue; there is no data plane exposure.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.