Three critical NGINX web server flaws could allow code execution

On October 14, F5, the vendor behind the NGINX web server, released out-of-band patches for eleven vulnerabilities. CERT-FR, the French government's monitoring and alert center, relayed them on October 19. F5 rates three of them as critical: CVE-2026-15176, CVE-2026-93479 and CVE-2026-97205.

An attacker can trigger them remotely, without authentication, using specially crafted HTTP requests. They cause a memory overflow or the reuse of an already freed memory area in NGINX's worker process, which crashes or restarts. If ASLR, the protection that places memory at random addresses, is disabled or bypassed, they could also allow code execution. F5 reports no exploitation at this stage.

Not every configuration is exposed

The three critical flaws affect only non-default configurations, BleepingComputer points out. According to the NGINX project's advisories:

• CVE-2026-15176 affects use of the alias directive combined with a URL rewrite, from version 0.1.29 through 1.31.6;
• CVE-2026-93479, an overflow during script evaluation, affects versions 1.30.0 to 1.30.5 and 1.31.2 to 1.31.6;
• CVE-2026-97205 targets asynchronous I/O (AIO), from 0.8.11 through 1.31.6.

On its own advisory page, the NGINX project rates these flaws "medium" severity. The gap comes from the scoring method: each gets 8.1 (high) under CVSS version 3.1, but 9.2 (critical) under version 4.0. The other eight flaws could, among other things, allow attackers to bypass checks, read sensitive information, inject data into proxied requests or reach protected paths before authentication, according to SecurityWeek. They include an injection in the body of HTTP/3 requests and a session forgery tied to TLS tickets.

Which versions should you install?

The web server is not the only product affected: the list also covers products built around it, including the Kubernetes ingress controller. The fixed versions noted by CERT-FR:

• NGINX Open Source: 1.30.6 (stable branch) or 1.31.7 (mainline branch);
• NGINX Plus: 37.0.5.1 or 37.1.0.1;
• NGINX Ingress Controller: 5.7.0; NGINX Gateway Fabric: 2.8.0; NGINX Instance Manager: 2.24.0;
• F5 WAF for NGINX: 5.14.2 or 5.16.0; F5 DoS for NGINX: 4.11.0; NGINX JavaScript: 1.0.2.

If you use the NGINX package from your Linux distribution, check its security bulletin: the fix may be backported under a different version number.

Until you can update

F5 offers workarounds for each critical flaw:

• CVE-2026-15176: avoid the alias directive in a location block and the $request_filename variable;
• CVE-2026-97205: disable asynchronous I/O (AIO) or server-side includes (SSI);
• CVE-2026-93479: use named captures in regular expressions, and only in the block that contains the expression.

F5 is a known target. According to BleepingComputer, CISA, the U.S. cybersecurity agency, has listed eight F5 flaws exploited since November 2021, four of them by ransomware groups. In October 2025, F5 also disclosed that state-backed hackers had stolen source code from it. What to watch for now: the release of exploit code, which would make these flaws much easier to use.