CriticalCVE
F5 releases out-of-band patches for critical NGINX vulnerabilities
BleepingComputer·Source published ·1 min read
What happened?
F5 has released out-of-band security patches to address multiple NGINX web server flaws, including three critical-severity vulnerabilities that can let attackers execute code on vulnerable systems. [...]
Key details
- F5 issued out-of-band patches for three critical NGINX vulnerabilities allowing remote code execution.
- The critical flaws reside in the ngx_http_v3_module and the NGINX map directive.
- Unauthenticated attackers can exploit these to cause DoS or achieve code execution on non-default configurations.
- Exploitation triggers heap buffer overflow or use-after-free in the worker process, causing crashes or restarts.
- Code execution is possible when ASLR is disabled or can be bypassed by the attacker.
- Patches cover NGINX Plus, Open Source, Ingress Controller, Gateway Fabric, and Instance Manager.
- F5 has not confirmed active exploitation, but threat groups have repeatedly targeted F5 products in recent years.
Affected
- NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, NGINX Instance Manager.
Fixes and mitigations
- Mitigate CVE-2026-15176 by avoiding the 'alias' directive in a location block or the $request_filename variable.
- Mitigate CVE-2026-93479 by using named captures instead of unnamed captures and limiting them to the regex match block.
Summarised by SecOraLens from BleepingComputer. Always read the original source before acting. How SecOraLens verifies advisories.