F 5 has released patches for eleven security issues in NGINX, including several critical remote‑code-execution (RCE) flaws. The most severe flaws, CVE-2026-15176 and CVE-2026-93479, are heap‑based buffer overflows that could be exploited without authentication via crafted HTTP requests under specific configurations. In these cases, attackers might trigger a denial of service or, potentially, execute arbitrary code if ASLR is disabled or can be bypassed.
The conditions involve particular uses of the alias directive with the $request_filename variable and, for the second CVE, specific references to regular‑expression capture variables from the map directive or the use of a non‑cacheable variable in a string expression, under certain circumstances.
A third critical flaw, CVE-2026-97205, is a use‑after‑free condition in the NGINX ngx_http_core_module that can, when asynchronous file I/O (AIO) is enabled, lead to memory corruption or unexpected worker termination while processing Server Side Includes (SSI) pages containing include virtual commands. This vulnerability could allow a remote attacker to cause a denial‑of‑service or potentially achieve code execution, particularly if ASLR is disabled or bypassed.
F5 describes these issues as affecting both NGINX Open Source and NGINX Plus, and notes that the fixes address a broader set of eleven issues beyond the three highlighted. The article presents CVSS scores of 9.2 for the three critical flaws and outlines the practical risk and the need for timely patching. Further details and patch information are linked from F5’s advisory.