Recent disclosures by F5 have uncovered serious security flaws in NGINX Plus and NGINX Open Source, potentially opening servers to remote attacks. These vulnerabilities allow attackers to crash server processes using crafted HTTP requests, posing significant risks to server stability.
Impact and Technical Details
The identified vulnerabilities could lead to unauthorized code execution if specific conditions are met, such as the disabling of Address Space Layout Randomization (ASLR). These flaws, found in the NGINX data plane responsible for handling user traffic, are cataloged as CVE-2026-97205, CVE-2026-93479, and CVE-2026-15176. Released on October 14, 2026, each vulnerability has been rated critically high, emphasizing the urgent need for server administrators to take action.
Understanding the Specific Flaws
CVE-2026-97205 involves a use-after-free issue within the ngx_http_core_module, triggered under configurations where asynchronous file I/O is active. This flaw could result in memory corruption or unexpected server shutdowns. Meanwhile, CVE-2026-93479 relates to a heap buffer overflow in the NGINX map directive. This vulnerability can cause workers to write beyond allocated memory when handling regex captures improperly.
CVE-2026-15176 also involves a heap buffer overflow within ngx_http_core_module, affecting configurations that improperly combine alias directives with rewrite rules. These conditions allow remote, unauthenticated exploitation, although specific server configurations limit their likelihood.
Mitigation and Recommendations
F5 advises urgent updates to NGINX Open Source and NGINX Plus to mitigate these vulnerabilities. Specifically, NGINX Open Source users should upgrade to versions 1.31.7 or 1.30.6, while NGINX Plus users should move to 37.0.5.1 or 37.1.0.1. Additional affected products include NGINX Instance Manager, F5 WAF for NGINX, and others, with recommended versions provided by F5.
Where immediate updates are not feasible, administrators can apply configuration changes to reduce risks. Disabling AIO or SSI for CVE-2026-97205, replacing unnamed regex captures for CVE-2026-93479, and reconfiguring location blocks for CVE-2026-15176 are advised strategies. Properly verifying configurations using nginx -T and checking syntax with nginx -t are critical steps to ensure system stability post-adjustment.
These newly disclosed vulnerabilities follow a series of memory-safety fixes in NGINX throughout 2026. Although no active exploitation of these flaws has been reported, swift action is necessary to prevent potential disruptions and unauthorized server access.
