CriticalAPTCVE-2026-97205
Multiple NGINX Flaws Let Remote Attackers Crash Servers and Execute Malicious Code
Cyber Security News·Source published ·1 min read
What happened?
F5 has disclosed three serious security flaws in NGINX Plus and NGINX Open Source that can let remote, unauthenticated attackers crash worker processes by sending crafted HTTP requests. In certain setups, the memory errors could also allow code execution, although F5 says that outcome requires Address Space Layout Randomization, known as ASLR, to be disabled or bypassed. All three issues affect the NGINX data plane, which handles user traffic, rather than its control plane. The flaws are tracked as CVE-2026-97205, CVE-2026-93479, and CVE-2026-15176.
Key details
- Three NGINX flaws let unauthenticated remote attackers crash workers via crafted HTTP requests.
- NGINX Plus 37.0.0 to 37.0.4 is affected by all three bugs.
- Fixed versions available: Open Source 1.31.7, 1.30.6; Plus 37.0.5.1, 37.1.0.1.
Affected
- NGINX Plus 37.0.0 through 37.0.4 is affected by all three bugs.
- Related products including NGINX Instance Manager, F5 WAF for NGINX, and NGINX Gateway Fabric are also affected.
Fixes and mitigations
- Upgrade NGINX Open Source to 1.31.7 or 1.30.6.
- Replace unnamed regex captures with named captures for CVE-2026-93479.
- Avoid alias inside location blocks and avoid $request_filename for CVE-2026-15176.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.