Are your NGINX gateways exposed to F5’s latest critical memory flaws?
F5 has issued emergency patches for three severe vulnerabilities in NGINX components that could enable remote code execution or denial-of-service attacks.
Key points
- Three critical flaws rated 9.2 on CVSS v4.0 affect multiple NGINX products.
- Exploitation could lead to heap buffer overflows, system crashes, or code execution.
- F5 advises immediate upgrades but reports no known wild exploitation yet.
The short version
- F5 released out-of-band patches for CVE-2026-15176, CVE-2026-97205 and CVE-2026-93479.
- Affected software includes NGINX Plus, Open Source, Ingress Controller and Gateway Fabric.
- Flaws reside in ngx_http_core_module and map directive, risking memory corruption.
The details
F5 has distributed emergency software updates to address three critical-severity vulnerabilities in its NGINX portfolio. According to CSO Online, these out-of-band patches tackle flaws rated 9.2 on the Common Vulnerability Scoring System version 4.0. The issues, identified as CVE-2026-15176, CVE-2026-97205 and CVE-2026-93479, impact NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric and NGINX Instance Manager. The vendor states that no evidence exists of these issues being exploited in the wild, though it strongly recommends customers install the fixed versions immediately.
The context
The vulnerabilities primarily involve memory corruption within the ngx_http_core_module. CSO Online reports that CVE-2026-15176 and CVE-2026-97205 can cause heap buffer overflows in server worker processes. This corruption may lead to system crashes or restarts, potentially granting attackers access. If Address Space Layout Randomisation is disabled or bypassed, threat actors could execute arbitrary code. CVE-2026-93479 is a map directive flaw allowing crafted HTTP requests to trigger similar heap buffer overflows and code execution risks.
Next steps
Organisations using affected NGINX versions should verify their current software status against the vendor’s advisory. Security teams must prioritise patching for internet-facing instances, as these components often handle TLS termination and act as reverse proxies. Frank Dickson of Dickson Research noted that compromising NGINX could expose session cookies, API tokens and private keys. Teams should review access logs for unusual traffic patterns preceding any potential crash or restart events during this transition period.
What defenders should look for
Teams usually monitor for sudden worker process terminations or unexpected service restarts in web server logs, which can indicate memory corruption attempts. Check whether error logs show heap buffer overflow signatures or segmentation faults correlating with specific HTTP request patterns. Analysts often review access logs for unusual query strings or headers targeting map directives, as these may precede exploitation. Initial containment typically involves isolating affected ingress controllers from external traffic while verifying patch status, ensuring that no active sessions are compromised during the remediation window.
Background: Threat actors
Threat actors are individuals or groups who initiate cyber attacks. They range from lone hackers to state-sponsored organisations. Understanding their motives helps you predict behaviour. You must monitor for anomalies, not just known signatures, to detect their presence before data exfiltration occurs.
Read the full guide: What Is Threat Actors: Definitions, Tactics and Detection Strategies
What to do and how to stay safe: F5
- Audit all NGINX deployments, including Open Source and Plus variants, for the affected versions.
- Apply the latest out-of-band patches provided by F5 to mitigate code execution risks.
- Monitor system logs for abnormal worker process crashes or memory-related errors.
- Restrict external access to NGINX instances until patching is confirmed across the environment.
Step-by-step guide: How Virtual Patching Works: The Mechanics Behind Inline Protection
General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which NGINX products are affected by these new vulnerabilities?
NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric and NGINX Instance Manager are impacted.
Are attackers currently exploiting these flaws in the wild?
F5 has not discovered any evidence that these issues are being exploited in the wild at this time.
What is the severity rating of these vulnerabilities?
The three flaws are rated 9.2 on the Common Vulnerability Scoring System version 4.0.
