Multiple NGINX Flaws Enable Server Crashes and Potential Code Execution
F5 has disclosed three critical vulnerabilities in NGINX Plus and Open Source that could allow remote attackers to crash servers or execute malicious code.
F5 has announced the discovery of three significant security vulnerabilities affecting both NGINX Plus and NGINX Open Source. These flaws, identified as CVE-2026-97205, CVE-2026-93479, and CVE-2026-15176, are present in the NGINX data plane, which is responsible for handling user traffic. The vulnerabilities, rated High (8.1 CVSS v3.1) and Critical (9.2 CVSS v4.0), could permit unauthenticated remote attackers to crash worker processes by sending specially crafted HTTP requests. In specific configurations, particularly where Address Space Layout Randomization (ASLR) is disabled or bypassed, these memory errors could potentially lead to remote code execution.
The first vulnerability, CVE-2026-97205, is a use-after-free flaw within the ngx_http_core_module. This issue can be triggered when NGINX is configured with asynchronous file I/O (AIO) and processes a Server Side Includes (SSI) page that contains an <!--# include virtual --> command. The vulnerability arises when NGINX attempts to use memory after it has already been released, leading to memory corruption or an unexpected shutdown of the worker process. This flaw was reported by security researcher Cyberlanc3r.
CVE-2026-93479 is a heap buffer overflow vulnerability associated with the NGINX map directive and regular expression matching. The vulnerability can occur when the root directive or an access_log format utilizes map regex capture variables before the map output variable, or when a non-cacheable variable is used in a string expression. Sending crafted HTTP requests can cause a worker process to write beyond its allocated memory buffer, resulting in a crash and restart. This issue was disclosed in coordination with researchers Matt Suiche of Tolmo and Mateusz Gierblinski.
The third vulnerability, CVE-2026-15176, is another heap buffer overflow, also within the ngx_http_core_module. It specifically affects location blocks that combine the alias directive with a rewrite directive and a set or return directive referencing $request_filename. A similar risk exists if $request_filename is used within an access_log_format. While an unauthenticated remote attacker can trigger this flaw, its exploitability is contingent on specific server-side configurations that are not directly controlled by the attacker.
The scope of affected NGINX versions is broad. CVE-2026-97205 and CVE-2026-15176 impact NGINX Open Source versions 1.31.0 through 1.31.6 and 1.0.0 through 1.30.5, with older 0.x versions also affected by CVE-2026-15176. CVE-2026-93479 affects NGINX Open Source 1.31.2 through 1.31.6 and 1.30.0 through 1.30.5. For NGINX Plus, versions 37.0.0 through 37.0.4 are vulnerable to all three issues. Additionally, related products such as NGINX Instance Manager, F5 WAF for NGINX, NGINX Gateway Fabric, and certain NGINX Ingress Controller releases are also impacted.
F5 has released patches for these vulnerabilities. Administrators are advised to upgrade NGINX Open Source to 1.31.7 or 1.30.6, and NGINX Plus users to 37.0.5.1 or 37.1.0.1. Patches are also available for affected related products. For instances where immediate patching is not feasible, F5 recommends specific configuration workarounds. These include disabling AIO or SSI for CVE-2026-97205, using named regex captures for CVE-2026-93479, and avoiding the alias directive with $request_filename for CVE-2026-15176.
These disclosures follow a series of other NGINX security fixes throughout 2026, highlighting ongoing challenges in maintaining the security of widely deployed web server software. While F5 has not reported active exploitation of these specific flaws, the potential for denial-of-service and remote code execution makes prompt patching and mitigation crucial for internet-facing NGINX systems. The provided workarounds offer partial mitigation but applying the fixed releases remains the most robust defense against these vulnerabilities.