F5 has released emergency security updates for its NGINX web server software, fixing several flaws, including three rated critical that let an attacker with no login crash servers and, in some setups, run malicious code, BleepingComputer reported Monday. F5 says it has not seen the bugs exploited. NGINX often handles a company's web traffic before it reaches the applications behind it, so the release gives security teams a short window to find and patch every copy before attackers study the fixes.

What Happened

The updates are "out-of-band," meaning F5 shipped them outside its regular patch schedule. The three critical flaws are tracked as CVE-2026-15176, CVE-2026-97205 and CVE-2026-93479. CSO Online reported that each scores 9.2 out of 10 on version 4.0 of the Common Vulnerability Scoring System, the industry's standard severity scale.

According to BleepingComputer, a remote attacker without any account can trigger memory-corruption errors, known as a heap buffer overflow and a use-after-free, in which software writes past or reuses memory it should not touch. The errors hit NGINX's worker process, the part that handles incoming requests, and cause it to crash or restart, which amounts to a denial of service. Running code is possible where address space layout randomization (ASLR), a standard defense that scrambles where programs sit in memory, is turned off or can be bypassed. BleepingComputer said the code-execution risk applies to systems with non-default configurations. CSO Online reported that CVE-2026-93479 sits in NGINX's map directive and can be reached with crafted web requests.

RelatedCritical Linux Flaw Lets a Virtual Machine Break Out to Its Host; Red Hat Fix Still Pending

The fixes cover NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric and NGINX Instance Manager. Neither BleepingComputer nor CSO Online listed fixed version numbers. F5 sets those out in advisories K000162416, K000162608 and K000162607, and administrators should confirm versions there before declaring systems patched.

For organizations that cannot update right away, F5 described workarounds, as reported by both outlets:

  • CVE-2026-15176: avoid the alias directive in location blocks and the $request_filename variable.
  • CVE-2026-97205: turn off asynchronous file input/output or Server Side Includes.
  • CVE-2026-93479: use named rather than unnamed regular-expression captures, limited to the block containing the match.

Why It Matters

NGINX frequently sits in front of other systems as a reverse proxy, the gateway that unwraps encrypted connections and passes requests along. Frank Dickson of Dickson Research told CSO Online that code execution on such a machine "means seeing passwords, session cookies, and API tokens in the clear." A flaw in one web server can therefore become a credential problem for every application behind it.

The lack of attacks so far is no guarantee of time. BleepingComputer noted that the Cybersecurity and Infrastructure Security Agency (CISA) has flagged eight F5 vulnerabilities as exploited since November 2021, four of them in ransomware attacks. F5 also disclosed in October 2025 that state-sponsored hackers had breached its systems in August 2025 and stolen source code and information on undisclosed security flaws in its BIG-IP products.

For executives, the practical question is inventory. NGINX ships in several forms, including ingress controllers and gateways that teams may not track as "NGINX" at all. Dickson also stressed to CSO Online that a vendor publishing a fix does nothing until it is installed on each server, which makes verification as important as the patch itself.

Context

These are not the first NGINX security releases this year. CSO Online pointed to CVE-2026-42530, disclosed in June, and CVE-2026-42945, a flaw nicknamed "NGINX Rift" that was disclosed in May with a public proof-of-concept showing remote code execution. Seva Ioussoufovitch, a senior research analyst at Infotech, told the outlet the trend of repeated NGINX security releases is likely to continue.

F5 says it serves more than 23,000 customers, including 80% of the Fortune Global 500, according to BleepingComputer.

What to Watch

  • Public exploit code. The May "NGINX Rift" flaw drew a working proof-of-concept, and published patches give attackers a map to the bugs.
  • Whether CISA adds any of the three flaws to its Known Exploited Vulnerabilities catalog, its list of flaws confirmed to be under attack.
  • Updates to F5's three advisories, including any change to the list of affected versions or exploitation status.