F5 has released security updates addressing five vulnerabilities in NGINX Open Source and NGINX Plus, including three critical memory-safety flaws that could allow unauthenticated attackers to crash web servers or potentially execute arbitrary code under certain conditions.
The vulnerabilities, disclosed on October 14, 2026, affect several components responsible for HTTP request processing, TLS session management, and reverse-proxy operations. F5 assigned the three most serious issues CVSS v4.0 scores of 9.2, while the remaining vulnerabilities received scores of 8.3 and 6.9.
The company released NGINX Open Source versions 1.30.6 (stable) and 1.31.7 (mainline) to address all five issues, according to the project’s official security advisories.
Three vulnerabilities involve memory corruption that could potentially lead to remote code execution.
The first, CVE-2026-97205, is a use-after-free vulnerability involving asynchronous file I/O and the Server Side Includes (SSI) module. It occurs when asynchronous file I/O is enabled in certain configurations and NGINX processes SSI pages containing virtual include commands.
Successful exploitation could corrupt worker-process memory, cause service disruptions, or potentially enable code execution if Address Space Layout Randomization (ASLR) is disabled or bypassed.
A second critical flaw, CVE-2026-93479, affects configurations involving regular-expression matching in the map directive and certain variable-evaluation operations.
An unauthenticated attacker could exploit the resulting heap-based buffer overflow using specially crafted HTTP requests. Depending on the server configuration and memory protections, the vulnerability could cause worker-process crashes or potentially enable arbitrary code execution.
The third memory-corruption issue, CVE-2026-15176, affects configurations combining the alias and rewrite directives with particular references to the $request_filename variable. This vulnerability can trigger a heap-based buffer overflow, creating similar risks of denial-of-service attacks and potential remote code execution when ASLR protections are absent or can be bypassed.
CVE-2026-97629, rated 8.3 under CVSS v4.0, affects the ngx_http_ssl_module component when shared SSL session caching is configured without explicitly defined session-ticket keys. Under certain conditions, an unauthenticated attacker could forge TLS client sessions and potentially bypass client-certificate verification, exposing resources or information intended only for authenticated users.
Meanwhile, CVE-2026-95101, rated 6.9, affects HTTP/3 request processing when the proxy_request_buffering directive is enabled. The flaw could allow unauthenticated attackers to inject data into requests forwarded to backend servers, potentially compromising request integrity.
Although F5’s CVSS v4.0 assessments classify three vulnerabilities as critical, the NGINX project lists all five as medium severity. Exploitation depends on particular configurations or additional technical conditions, meaning affected software versions are not necessarily exploitable in every deployment.
The security issues also extend to certain F5 products that incorporate NGINX components, including NGINX Ingress Controller, NGINX Gateway Fabric, and F5 WAF for NGINX.
Administrators are advised to upgrade affected NGINX Open Source installations to versions 1.30.6 or 1.31.7. NGINX Plus users should update to 37.0.7.1 (LTS) or 37.2.0.1 (Continuous Release) to address all five vulnerabilities, including the HTTP/3 request-injection flaw.
Organizations using other affected F5 products should consult the company’s product-specific advisories for appropriate updates and mitigations. Where immediate patching is not possible, F5 has documented configuration-based measures that can reduce exposure to certain vulnerabilities.
Leave a Reply