F5 has published fixes for three memory-safety vulnerabilities in NGINX Plus and NGINX Open Source. A remote, unauthenticated attacker can trigger the flaws with crafted HTTP requests when a server is running an affected version and configuration, causing worker processes to crash. Under more difficult conditions, the same corruption could lead to malicious code execution.

The issues are CVE-2026-97205, CVE-2026-93479, and CVE-2026-15176. F5 rated each High with a CVSS 3.1 score of 8.1 and Critical under CVSS 4.0 at 9.2. All three affect the data plane that handles user traffic, making internet-facing servers a natural priority for review.

Three bugs with different triggers

CVE-2026-97205 is a use-after-free condition in ngx_http_core_module. It can arise when asynchronous file I/O is enabled and NGINX processes a Server Side Includes page containing an include virtual instruction. The worker may continue using memory after it has been released, leading to corruption or an unexpected shutdown.

CVE-2026-93479 is a heap buffer overflow involving the map directive and regular-expression matching. Risky configurations use regex capture variables in a root directive or access-log format before the map output variable. Crafted requests can then cause a write beyond the allocated memory area.

CVE-2026-15176 is another heap buffer overflow in the core HTTP module. It affects certain location blocks that combine alias with rewrite and a set or return directive referencing $request_filename. The variable’s use in an access log format can expose a related path.

None of these configurations is controlled by the remote attacker, so an affected software version alone does not prove exploitability. When the necessary condition is present, however, a request can be sent without authentication. Code execution is considered possible if Address Space Layout Randomization is disabled or successfully bypassed.

Affected releases and fixes

The affected ranges differ. CVE-2026-97205 and CVE-2026-15176 affect NGINX Open Source 1.31.0 through 1.31.6 and 1.0.0 through 1.30.5, with the older 0.x family also listed for CVE-2026-15176. CVE-2026-93479 affects 1.31.2 through 1.31.6 and 1.30.0 through 1.30.5. NGINX Plus 37.0.0 through 37.0.4 is affected by all three.

NGINX Open Source users should upgrade to 1.31.7 or 1.30.6. NGINX Plus customers on 37.x should move to 37.0.5.1 or 37.1.0.1. F5 also lists fixed versions for related products:

• NGINX Instance Manager 2.24.0;
• F5 WAF for NGINX 5.16.0 or 5.14.2;
• NGINX Gateway Fabric 2.8.0;
• NGINX Ingress Controller 5.7.0.

Some older branches have no corrected build, requiring migration to a supported line. Administrators should consult the individual advisories because bundled products and deployment methods may have their own upgrade requirements.

Temporary configuration defenses

Where an immediate update is impossible, F5 recommends disabling either asynchronous I/O or SSI to reduce exposure to CVE-2026-97205. This involves tradeoffs: disabling AIO can affect performance for large static files or heavy media delivery, while disabling SSI prevents the server from processing SSI markup.

For CVE-2026-93479, unnamed regex captures should be replaced with named captures and used only within the matching block. For CVE-2026-15176, administrators should avoid combining alias with the affected location pattern and avoid $request_filename where feasible. These measures cover known unsafe paths but are not as durable as upgrading.

How to review NGINX deployments

Teams can run nginx -T to inspect the complete active configuration, including files loaded through include directives. That output should be compared against each vulnerability’s trigger and the installed build. After editing a configuration, nginx -t can validate syntax before a reload.

Asset discovery should extend beyond traditional web servers. Reverse proxies, ingress controllers, security products, and managed application stacks may embed NGINX. Owners should identify who is responsible for each instance and confirm whether the vendor or platform team has supplied a fixed package.

F5 has not reported active exploitation of these three flaws. Nonetheless, crafted requests can disrupt service, and weakening ASLR would increase the potential impact. Internet-facing deployments should be upgraded promptly, monitored for abnormal worker restarts, and reviewed for the configuration conditions that make exploitation possible.