F5 has released an emergency, out-of-band security patch package to address a number of security vulnerabilities discovered in the popular NGINX web server, including three critical severity vulnerabilities that grant attackers the ability to execute malicious code on affected systems under certain configuration conditions.
The three critical vulnerabilities are centered in the ngx_http_v3_module module and carry the identifiers (CVE-2026-15176) and (CVE-2026-97205), in addition to another vulnerability related to the NGINX map directive under the identifier (CVE-2026-93479). Technical report details indicate that unauthorized attackers with network access can exploit these vulnerabilities to execute denial of service (DoS) attacks or achieve code execution in running NGINX server processes, particularly on systems with non-default configurations or where security techniques such as Address Space Layout Randomization (ASLR) bypass are disabled.
Affected Products and Temporary Mitigation Options
The list of software affected by these vulnerabilities includes several versions and key products belonging to the company, including NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager. In the event that security teams and system administrators are unable to apply software updates immediately, the company has provided temporary workarounds to mitigate the risks:
- CVE-2026-15176: Can be mitigated by avoiding the use of the alias directive inside a location block or by dispensing with the $request_filename variable.
- CVE-2026-97205: Mitigated by disabling Asynchronous I/O (AIO) for files or the Server Side Includes (SSI) feature.
- CVE-2026-93479: Can be avoided by relying on named captures instead of unnamed captures and strictly limiting their use to regex matching blocks.
What Changes Practically for Organizations?
Although no active exploitation of these vulnerabilities has been observed at this time in field cyberattacks, the architecture of NGINX servers and related products has made them a frequent target for state-sponsored cyber threat actors and ransomware gangs in recent years, where previous attacks targeted corporate networks, device breaches, and sensitive data exfiltration.