Critical NGINX Flaws Let Remote Attackers Crash Servers, Execute Code

Key Takeaways

• Three critical vulnerabilities have been identified in NGINX Plus and NGINX Open Source.
• These flaws, rated High (CVSS v3.1) and Critical (CVSS v4.0), could allow remote attackers to crash NGINX worker processes.
• In specific, less common configurations, these memory errors could also enable remote code execution.
• Patches are available across various NGINX versions and related products; immediate upgrades are strongly recommended.

F5 has issued warnings regarding three significant security vulnerabilities impacting both NGINX Plus and NGINX Open Source. These flaws could permit unauthenticated, remote attackers to trigger denial-of-service conditions by sending specially crafted HTTP requests, leading to the crash of NGINX worker processes. Under certain, less common configurations, these memory corruption issues could potentially facilitate arbitrary code execution.

All three identified vulnerabilities reside within the NGINX data plane, which is responsible for processing user traffic, rather than the control plane. F5 released advisories for these issues on October 14, 2026. Each vulnerability received a “High” severity rating of 8.1 under CVSS v3.1 and a “Critical” rating of 9.2 under CVSS v4.0.

It is important to note that not all NGINX installations are vulnerable by default. Exploitation depends on specific software versions and particular configuration settings being active on the server.

Detailed Vulnerability Analysis

CVE-2026-97205: Use-After-Free in ngx_http_core_module

Tracked as CVE-2026-97205, this vulnerability is a use-after-free flaw found within the ngx_http_core_module. It can be exploited when asynchronous file I/O (AIO) is enabled and NGINX processes a Server Side Includes (SSI) page containing an include virtual command. This scenario can cause an NGINX worker to continue accessing memory after it has been deallocated, resulting in memory corruption or an unexpected shutdown of the worker process. Security researcher Cyberlanc3r is credited by F5 for reporting this issue.

CVE-2026-93479: Heap Buffer Overflow with map directive

CVE-2026-93479 describes a heap buffer overflow vulnerability related to the NGINX map directive and regular expression matching. This unsafe condition arises when the root directive or an access-log format attempts to use regex capture variables from the map before the map’s output variable is properly defined. A similar risk exists when a non-cacheable variable is used within a string expression. Maliciously crafted requests can then cause a worker process to write beyond its allocated memory buffer, leading to a restart. F5 acknowledges Matt Suiche of Tolmo and Mateusz Gierblinski for their coordinated disclosure of this flaw.

CVE-2026-15176: Heap Buffer Overflow in ngx_http_core_module

A distinct heap buffer overflow, identified as CVE-2026-15176, also affects the ngx_http_core_module. This vulnerability manifests within a location block that combines the alias directive with rewrite and a set or return directive referencing $request_filename. The same risk can occur if $request_filename is used within an access log_format. F5 indicates that a remote attacker can trigger this flaw without authentication, though the necessary server-side configuration conditions are not directly controlled by the attacker. This issue was discovered internally by F5.

Affected Versions and Patches

The range of affected NGINX versions is extensive. CVE-2026-97205 and CVE-2026-15176 impact NGINX Open Source versions 1.31.0 through 1.31.6, and 1.0.0 through 1.30.5. The older 0.x line is also listed as vulnerable for CVE-2026-15176. CVE-2026-93479 has a slightly narrower scope for open-source versions, affecting 1.31.2 through 1.31.6, and 1.30.0 through 1.30.5. All three vulnerabilities affect NGINX Plus versions 37.0.0 through 37.0.4.

Several related products are also impacted, including NGINX Instance Manager, F5 WAF for NGINX, NGINX Gateway Fabric, and specific releases of the NGINX Ingress Controller.

To mitigate these risks, administrators should upgrade NGINX Open Source to version 1.31.7 or 1.30.6. NGINX Plus users on the 37.x branch must update to 37.0.5.1 or 37.1.0.1. Patched releases also include NGINX Instance Manager 2.24.0, F5 WAF for NGINX 5.16.0 or 5.14.2, NGINX Gateway Fabric 2.8.0, and NGINX Ingress Controller 5.7.0. For older branches without direct updates, F5 advises migrating to a supported branch that incorporates the necessary fixes.

F5’s advisories currently do not indicate active exploitation of these newly disclosed vulnerabilities. However, due to the potential for service disruption and the elevated risk of code execution if Address Space Layout Randomization (ASLR) is bypassed, a rapid review and patching of internet-facing NGINX systems are crucial.

What You Should Do

• Upgrade Immediately: The most robust defense is to apply the latest patched versions of NGINX Open Source (1.31.7 or 1.30.6) or NGINX Plus (37.0.5.1 or 37.1.0.1) as soon as possible. Update all affected related products.
• Review Configuration: Before and after applying any changes, run nginx -T to inspect your full active configuration, including all included files. This helps confirm whether your setup is susceptible to the specific conditions required for exploitation.
• Validate Syntax: After making any configuration modifications, use nginx -t to check the syntax before reloading NGINX.
• Implement Workarounds (if immediate patching is not possible):
  • For CVE-2026-97205: Disable either AIO (asynchronous file I/O) or SSI (Server Side Includes). Be aware that disabling AIO might impact performance for large static files or media streaming under heavy loads.
  • For CVE-2026-93479: Replace unnamed regex captures with named captures and ensure they are only used within their matching block.
  • For CVE-2026-15176: Avoid using the alias directive within a location block and minimize the use of $request_filename where possible.
• Monitor for Exploitation: Remain vigilant for any unusual activity or service disruptions that might indicate attempted exploitation.
• Consider ASLR: While ASLR is often enabled by default, ensure it is active to mitigate the potential for remote code execution, as these flaws could become more severe if ASLR is disabled or bypassed.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.