F5 Patches Critical NGINX Heap Overflow and Use-After-Free Flaws

F5 issued out-of-band security updates to address three critical-severity vulnerabilities in NGINX web server software, according to BleepingComputer. These flaws reside in the ngx_http_v3_module and the NGINX map directive. Attackers without privileges can exploit them to execute code or launch denial-of-service attacks against systems using non-default configurations. The issues involve heap-based buffer overflows and use-after-free errors within the NGINX worker process.

Root cause

The vulnerabilities stem from memory handling errors in specific NGINX modules. CVE-2026-15176 and CVE-2026-97205 are located in the ngx_http_v3_module. CVE-2026-93479 affects the map directive. Successful exploitation triggers a heap-based buffer overflow or a use-after-free condition. This leads to worker process crashes or restarts. In environments where Address Space Layout Randomization is disabled or bypassed, attackers may achieve remote code execution.

Attack path

Remote attackers can trigger these flaws without prior authentication. The initial impact is often a denial-of-service condition due to worker process crashes. However, the potential for code execution exists if ASLR protections are absent or circumvented. BleepingComputer notes that while F5 has not flagged these specific issues as exploited in the wild, threat groups have frequently targeted F5 products in recent years for network breaches and data theft.

Affected versions

The patches apply to multiple NGINX products, including:

• NGINX Plus
• NGINX Open Source
• NGINX Ingress Controller
• NGINX Gateway Fabric
• NGINX Instance Manager

Mitigation

Administrators who cannot immediately patch can apply temporary workarounds:

• Disable the 'alias' directive in location blocks and avoid using the $request_filename variable to mitigate CVE-2026-15176.
• Disable asynchronous file I/O or Server Side Includes to mitigate CVE-2026-97205.
• Use named captures instead of unnamed ones and limit their scope to regex match blocks for CVE-2026-93479.

Detection notes

Security teams should monitor for unexpected NGINX worker process restarts or crashes, which may indicate exploitation attempts. Review access logs for unusual request patterns targeting HTTP/3 endpoints or map directive configurations. Check for signs of post-exploitation activity, such as new processes spawned by the web server user. Isolate affected instances from the

What to do and how to stay safe

• Firewalls cannot stop attacks that originate from inside your network or use allowed ports.
• Antivirus software struggles to detect new exploits that do not yet have a known signature.
• Third-party libraries and plugins often introduce vulnerabilities that the main application vendor cannot fix.

Unpatched software remains a critical vulnerability regardless of your other security measures. Audit your software inventory regularly and apply patches promptly to close known entry points.

Step-by-step guide: Unpatched Software Myths: Why Common Beliefs Fail to Protect You

General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.