F5 has released emergency security patches to fix three critical flaws in NGINX, its widely-used software that manages digital traffic for websites, according to a report published by CSO Online. The vulnerabilities could enable attackers to crash systems, run malicious code, and launch denial of service attacks. While F5 hasn't found evidence that the flaws are being actively exploited, the company is urging customers to upgrade immediately.
The three vulnerabilities—CVE-2026-15176, CVE-2026-97205, and CVE-2026-93479—each received a severity rating of 9.2 under version 4.0 of the Common Vulnerability Scoring System. The flaws affect multiple F5 products, including NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager. The first two flaws are ngx_http_core_module vulnerabilities that can trigger heap buffer overflow in the server's worker process, potentially leading to system crashes or restarts that give attackers access. The third is a map directive flaw that similarly allows attackers to send specially crafted HTTP requests to cause heap buffer overflow. All three could let threat actors execute code on systems where Address Space Layout Randomization is turned off, or allow them to circumvent ASLR entirely.
According to Frank Dickson of Dickson Research, "NGINX is the front door: Reverse proxy, load balancer, and Kubernetes ingress," adding that transport layer security typically terminates in NGINX and that "code execution on that box means seeing passwords, session cookies, and API tokens in the clear, plus the private keys that make it all trustworthy." Seva Ioussoufovitch, senior research analyst at Infotech, warned that "since NGINX is used across a wide swath of systems, this may increase the risk of service availability loss for many enterprises." The report notes F5 provided workarounds: customers can address CVE-2026-15176 by not using the $request_filename variable and the alias directive in a location block, while CVE-2026-97205 can be mitigated by turning off asynchronous file I/O and Server Side Includes.
The latest disclosures come as F5 has repeatedly faced cybersecurity incidents in recent years, a troubling pattern given the company serves tens of thousands of customers, including 80% of Fortune 500 companies. Over the past five years, the US Cybersecurity and Infrastructure Security Agency has flagged eight actively-exploited F5 vulnerabilities, with four of those targeted in ransomware campaigns. The report points to a May incident involving CVE-2026-42945, a rewrite module overflow dubbed NGINX Rift that arrived with a public remote code execution proof of concept, as an earlier warning sign. Because the current flaws depend on configuration, enterprises should start with an audit of their NGINX configurations to prioritize patching efforts. Organizations also need to maintain a clear inventory of which systems run NGINX, including embedded instances, since many teams get NGINX from their Linux distribution rather than directly from the vendor, and fixes on the vendor's site don't automatically patch servers. Dickson advised that if immediate patching isn't possible, organizations should disable AIO or stop serving SSI pages, switch map to named captures, confirm ASLR is enabled, run workers without elevated privileges, and segment front-facing systems so they can't access critical assets. These vulnerabilities arrive at a moment when many security teams lack comprehensive visibility into their own infrastructure, making already-difficult patch cycles even harder to execute. For organizations that rely on NGINX as the entry point for customer-facing applications, the configuration-dependent nature of these flaws shifts the burden from simple software updates to deeper architectural reviews.