F5 releases out-of-band NGINX patches for three critical heap overflow flaws, none reported exploited

TLDR

• F5 released out-of-band NGINX patches for three critical flaws rated CVSS v4.0 9.2: CVE-2026-15176, CVE-2026-97205 and CVE-2026-93479.¹²
• The heap buffer overflows can crash the worker process, and allow code execution where ASLR is disabled or bypassed.¹²
• F5 has found no evidence of exploitation; the flaws depend on specific configurations, and workarounds are published.¹²³

BleepingComputer and CSO Online report that F5 has released out-of-band security patches for multiple NGINX flaws, including three critical ones: CVE-2026-15176, CVE-2026-97205 and CVE-2026-93479.¹² CSO Online rates each 9.2 on CVSS 4.0 and lists the affected products as NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric and NGINX Instance Manager.² BleepingComputer says unprivileged remote attackers can exploit them on systems with non-default configurations to cause denial of service or gain code execution, through a heap-based buffer overflow or use-after-free in the NGINX worker process that leads to a crash or restart.¹ Both outlets relay F5's statement that attackers may execute code on systems with Address Space Layout Randomization (ASLR) disabled or when they can bypass it.¹²

The sources differ on where two of the flaws sit. BleepingComputer places CVE-2026-15176 and CVE-2026-97205 in the ngx_http_v3_module and CVE-2026-93479 in the map directive, whereas CSO Online places the first two in the ngx_http_core_module.¹² The Centre for Cybersecurity Belgium advisory, which links F5's own notices, lists only CVE-2026-15176 (ngx_http_core_module, in configurations where a location uses the alias directive with rewrite and a set or return directive that references $request_filename) and CVE-2026-93479 (a map directive using regex matching whose capture variables are referenced before the map output variable).³ It gives affected NGINX Open Source versions of 0.1.29 to 1.30.5 and 1.31.0 to 1.31.6 for CVE-2026-15176, and 1.30.0 to 1.30.5 and 1.31.2 to 1.31.6 for CVE-2026-93479, and NGINX Plus R33 to R36, 37.0.0 to 37.0.5 and 37.1.0 for both.³

F5's suggested mitigations, as reported, are to avoid the alias directive in a location block and the $request_filename variable for CVE-2026-15176, to disable asynchronous file I/O and Server Side Includes for CVE-2026-97205, and to use named instead of unnamed captures, limited to the block containing the regex match, for CVE-2026-93479.¹² CSO Online says F5 has not found evidence that the flaws are being exploited in the wild, and BleepingComputer says F5 has not flagged them as exploited.¹² Seva Ioussoufovitch, a senior research analyst at Infotech, told CSO Online that the flaws are configuration-dependent and advised auditing current NGINX configurations to prioritise patching.²

BleepingComputer and CSO Online both recall that CISA has flagged eight actively exploited F5 vulnerabilities over about five years, four of them used in ransomware attacks, and CSO Online notes that a rewrite module overflow nicknamed NGINX Rift (CVE-2026-42945) arrived with a public remote code execution proof of concept in May.¹²

Why it matters: NGINX commonly sits at the front of web traffic as a reverse proxy, load balancer and Kubernetes ingress, so heap overflows in it are a risk for many organisations, and the configuration conditions in F5's notes give administrators a concrete way to check exposure before patching.²³