F5 Strengthens NGINX Security with Fixes for Critical Code Execution Flaws

Summary

F5 has released security updates addressing 11 vulnerabilities in NGINX, including three critical flaws that could potentially allow unauthenticated remote attackers to execute arbitrary code or cause denial-of-service (DoS) conditions. The vulnerabilities, tracked as CVE-2026-15176, CVE-2026-93479, and CVE-2026-97205, each carry a CVSS score of 9.2 (Critical). These flaws involve heap-based buffer overflows and a use-after-free condition affecting NGINX deployments under specific configuration conditions. Successful exploitation could trigger memory corruption, unexpected worker process termination, or potentially remote code execution when Address Space Layout Randomization (ASLR) protections are disabled or bypassed. Organizations relying on NGINX for web application delivery and reverse proxy services should prioritize identifying affected deployments and applying the appropriate security updates.

NGINX is a widely deployed web server, reverse proxy, load balancer, and HTTP caching solution used to deliver web applications and manage network traffic. Developed and maintained by F5, NGINX is available in both open-source and commercial editions, including NGINX Open Source and NGINX Plus.The vulnerabilities are particularly concerning for organizations operating internet-facing NGINX servers, as successful exploitation could disrupt critical web services or potentially compromise resources accessible to the affected server process.

Vulnerability Details

CVE ID	CVSS Score	EPSS Score	Affected Products	Vulnerability Type
CVE-2026-15176	9.2 (Critical)	0.52%	NGINX Plus and NGINX Open Source	Heap-Based Buffer Overflow
CVE-2026-93479	9.2 (Critical)	0.55%	NGINX Plus and NGINX Open Source	Heap-Based Buffer Overflow
CVE-2026-97205	9.2 (Critical)	0.44%	NGINX ngx_http_core_module	Use-After-Free

Technical Analysis

CVE-2026-15176: Heap-Based Buffer Overflow

CVE-2026-15176 is a critical heap-based buffer overflow vulnerability affecting NGINX Plus and NGINX Open Source. The flaw occurs under specific configurations involving the alias directive and the $request_filename variable, which are used during HTTP request processing and file path resolution.An unauthenticated remote attacker could send specially crafted HTTP requests to a vulnerable NGINX server, potentially triggering a heap-based buffer overflow. This could corrupt process memory and cause the affected NGINX worker process to terminate or restart, resulting in a denial-of-service condition.Under certain circumstances, particularly when ASLR is disabled or successfully bypassed, exploitation could potentially allow arbitrary code execution within the security context of the affected NGINX process.

CVE-2026-93479: Heap-Based Buffer Overflow

CVE-2026-93479is another critical heap-based buffer overflow vulnerability affecting NGINX Plus and NGINX Open Source. The vulnerability is associated with specific configurations involving the map directive, which allows administrators to define variables based on the values of other variables.The flaw may occur when regular-expression capture variables are referenced before the corresponding map output variable or when a non-cacheable variable is used within a string expression under certain conditions. This behavior could lead to improper memory handling during request processing. An unauthenticated attacker could exploit the vulnerable configuration through specially crafted HTTP requests, potentially causing memory corruption and unexpected worker process termination. Although denial of service is a primary concern, arbitrary code execution may also be possible when ASLR protections are disabled or bypassed.

CVE-2026-97205: Use-After-Free Vulnerability

CVE-2026-97205 is a critical use-after-free vulnerability affecting the NGINX ngx_http_core_module. The flaw occurs under specific configurations involving asynchronous file I/O (AIO) and Server Side Includes (SSI). When AIO is enabled, processing SSI pages containing include virtual commands may trigger unsafe memory access. A use-after-free condition occurs when an application attempts to access memory after it has already been released, potentially resulting in memory corruption, application instability, or unexpected process termination. A remote attacker could potentially exploit this condition to disrupt NGINX worker processes and cause denial of service. Under specific circumstances, particularly when ASLR is disabled or successfully bypassed, the vulnerability could also potentially result in arbitrary code execution.

Impact

1. 1. Remote Code Execution: Attackers could potentially execute arbitrary code within the privileges of the affected NGINX process under specific exploitation conditions.
2. 2. Denial of Service: Malicious HTTP requests could trigger worker process crashes or restarts, disrupting application availability.
3. 3. Memory Corruption: Heap-based buffer overflows and use-after-free conditions could compromise memory integrity and cause unpredictable application behavior.
4. 4. Application Service Disruption: Repeated exploitation could affect websites, APIs, and other services relying on vulnerable NGINX deployments.
5. 5. Potential Server Compromise: If arbitrary code execution is achieved, attackers could potentially access sensitive resources available to the compromised NGINX process.

Affected Versions

Affected Versions	Fixed Versions
NGINX Open Source 0.1.29 through 1.31.6	NGINX Open Source 1.30.6 and 1.31.7
NGINX Plus R33 through R36 and affected R37 builds	NGINX Plus 37.0.5.1 and 37.1.0.1

MITRE ATT&CK Mapping

Technique ID	Technique Name	Tactic
T1190	Exploit Public-Facing Application	Initial Access
T1499	Endpoint Denial of Service	Impact

Mitigation

1. 1. Apply the Latest F5 Security Updates: Review the official F5 security advisory and upgrade affected NGINX installations to the appropriate fixed releases. Prioritize internet-facing deployments and systems supporting critical business applications.
2. 2. Identify Vulnerable NGINX Configurations: Review configurations involving the alias directive, $request_filename variable, map directive, asynchronous file I/O, and SSI functionality to identify potentially vulnerable conditions.
3. 3. Maintain ASLR and Memory Protection Mechanisms: Ensure Address Space Layout Randomization and other applicable operating system memory protections remain enabled to reduce the likelihood of successful code execution.
4. 4. Restrict Unnecessary NGINX Functionality: Disable optional features that are not required for business operations, particularly where they contribute to vulnerable configuration conditions.

Instantly Fix Risks with Saner Patch Management

Saner patch management is a continuous, automated, and integrated software that instantly fixes risks exploited in the wild. The software supports major operating systems like Windows, Linux, and macOS, as well as 550+ third-party applications.

It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.

Experience the fastest and most accurate patching software here.