{"id":10065,"date":"2026-10-20T03:25:43","date_gmt":"2026-10-20T03:25:43","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=10065"},"modified":"2026-10-20T03:25:43","modified_gmt":"2026-10-20T03:25:43","slug":"f5-rushes-out-emergency-nginx-patches-for-three-critical-flaws","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=10065","title":{"rendered":"F5 rushes out emergency NGINX patches for three critical flaws"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

F5 is once again disclosing cybersecurity flaws in its core offerings.<\/p>\n

The app delivery and security provider has released out-of-band (OOB) security patches that address multiple flaws in NGINX, its high-performance software that controls digital traffic for websites. These include three critical-severity flaws that could allow attackers to crash systems, execute code, and launch denial of service (DoS)<\/a> attacks.<\/p>\n

OOB security patches are emergency software updates released outside of normal maintenance cycles.<\/p>\n

CVE-2026-15176<\/a>, CVE-2026-97205<\/a>, and CVE-2026-93479<\/a> are rated 9.2 in severity in the latest version (4.0) of the Common Vulnerability Scoring System (CVSS). Impacted software products include NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager.<\/p>\n

While F5 says it hasn\u2019t discovered evidence that these issues are being exploited in the wild, it advises customers to install or upgrade to fixed versions. Analysts agree. <\/p>\n

\u201cNGINX is the front door: Reverse proxy, load balancer, and Kubernetes ingress,\u201d said Frank Dickson<\/a> of Dickson Research, noting that transport layer security (TLS) usually terminates in NGINX. \u201cCode execution on that box means seeing passwords, session cookies, and API tokens in the clear, plus the private keys that make it all trustworthy.\u201d<\/p>\n

Allowing attackers to crash systems<\/h2>\n

CVE-2026-15176 and CVE-2026-97205 are ngx_http_core_module<\/em> vulnerabilities in F5\u2019s NGINX, which could cause a heap buffer overflow in the server\u2019s worker process. This type of memory corruption could lead to a system crashing or restarting, thus giving attackers access. Threat actors could also execute code on systems where Address Space Layout Randomization (ASLR), a technique intended to prevent exploitation by randomly arranging memory locations when an app starts, is disabled, or bypass ASLR altogether. The flaws could allow attackers to launch DoS attacks to make the server inaccessible to legitimate users, F5 explained.<\/p>\n

CVE-2026-93479 is similar, in that it is a map directive flaw that could allow attackers to send crafted HTTP requests to cause a heap buffer overflow; they can also execute code when ASLR is disabled, or bypass it.<\/p>\n

These vulnerabilities follow F5\u2019s disclosure of CVE-2026-42530<\/a> in June. The flaw in ngx_http_v3_module<\/em> in NGINX Open Source could also potentially allow remote attackers to cause DoS or trigger code execution.<\/p>\n

Customers can mitigate CVE-2026-15176 by avoiding use of the $request_filename<\/em> variable and the alias <\/em>directive in a location block, F5 said, and CVE-2026-97205 can be mitigated by disabling asynchronous file I\/O (AIO) and Server Side Includes (SSI). <\/p>\n

Meanwhile, F5 advised mitigating CVE-2026-93479 by avoiding unnamed captures and instead using named captures and limiting their usage to the block with the regex match.<\/p>\n

But, noted Seva Ioussoufovitch<\/a>, senior research analyst at Infotech, \u201csince NGINX is used across a wide swath of systems, this may increase the risk of service availability loss for many enterprises.\u201d<\/p>\n

The latest in a series of cybersecurity issues<\/h2>\n

While these three vulnerabilities are not known to be exploited in the wild, F5 has repeatedly borne the brunt of cyberattacks in recent years, which is troubling because the cybersecurity and app delivery networking (ADN) company serves tens of thousands of customers, including 80% of the Fortune 500, analysts noted.<\/p>\n

Threat actors have repeatedly targeted flaws in its systems and products to map internal servers, hijack devices, breach systems, steal sensitive documents, and deploy data-wiping malware<\/a>. Over the last five years, the US Cybersecurity and Infrastructure Security Agency (CISA) has flagged eight actively-exploited F5 vulnerabilities; four of these have been targeted in ransomware attacks<\/a>.<\/p>\n

For instance, a 2025 nation-state breach and CISA\u2019s Emergency Directive 26-01 centered on F5\u2019s BIG-IP, and F5 said at the time that NGINX source code was not accessed. But, Dickson noted, NGINX\u2019s own \u201cwarning shot\u201d came in May when CVE-2026-42945<\/a>, a rewrite module overflow nicknamed NGINX Rift, arrived with a public remote code execution proof of concept.<\/p>\n

\u201cThis week\u2019s alias and rewrite flaw lives in the same neighborhood,\u201d he said, pointing out, \u201cattackers read changelogs, too.\u201d<\/p>\n

Mitigation <\/h2>\n

Ioussoufovitch noted that the flaws are configuration-dependent, so enterprises should begin with an audit of current NGINX configurations to help risk-prioritize this patch. F5 also said that the risk of remote code execution (RCE) notably increases when ASLR is disabled, so users should double-check that ASLR and other typical OS-level protections are proactively enabled to at least limit the exploitation risk from similar types of attack.<\/p>\n

Enterprises need to ensure they have a clear inventory of which of their systems are running NGINX, including those where it is embedded in other products. This is critical to supporting configuration audits, segmentation efforts, and NGINX worker monitoring efforts, which can indicate that attackers \u201care poking at these types of vulnerabilities,\u201d Ioussoufovitch said.<\/p>\n

\u201cNGINX has already had multiple security releases this year, and I expect the trend to continue well into the future,\u201d he noted.<\/p>\n

Dickson agreed that inventorying is the first step. NGINX \u201chides inside\u201d ingress controllers, appliances, and container images. Many teams get NGINX from their Linux distribution, not nginx.org, and Amazon Linux still lists the AIO fix as pending.<\/p>\n

\u201cA fix on the vendor\u2019s site does not patch your servers,\u201d he cautioned.<\/p>\n

As well as performing the inventory, enterprises should search their configurations for aliases paired with rewrite, AIO paired with SSI, and map blocks using unnamed regex captures. <\/p>\n

If an organization cannot patch today, the workarounds are simple, Dickson said: Disable AIO or stop serving SSI pages; switch map to named captures; confirm ASLR is on, run workers unprivileged; and segment the front door so it cannot reach the crown jewels. And, watch for worker processes that keep restarting.<\/p>\n

\u201cThese flaws need the right configuration to bite, and that is the good news,\u201d Dickson said. \u201cThe bad news is that many organizations may not know what their NGINX configurations actually say.\u201d<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

F5 is once again disclosing cybersecurity flaws in its core offerings. The app delivery and security provider has released out-of-band (OOB) security patches that address multiple flaws in NGINX, its high-performance software that controls digital traffic for websites. These include three critical-severity flaws that could allow attackers to crash systems, execute code, and launch denial […]<\/p>\n","protected":false},"author":0,"featured_media":10066,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-10065","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10065"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=10065"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10065\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/10066"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=10065"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=10065"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=10065"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}