F 5 has issued three security advisories on 14 October 2026 detailing high‑risk NGINX vulnerabilities that affect NGINX Open Source and NGINX Plus, with memory corruption leading to remote code execution. The flaws are tracked as CVE-2026-97205 (Use-After-Free in ngx_http_core_module with asynchronous I/O and SSI), CVE-2026-93479 (heap buffer overflow in regex map directives), and CVE-2026-15176 (heap buffer overflow when combining alias and rewrite directives with $request_filename).
All three are rated 8.1 in CVSS v3.1 and 9.2 in CVSS v4.0, indicating critical impact. At the time of disclosure, there was no public PoC or active exploitation reported in the wild.
Affected products span NGINX Open Source and NGINX Plus ranges. For Open Source, versions 1.31.0–1.31.6 and 1.30.0–1.30.5 (plus legacy 1.0.0–1.30.5 and 0.1.29–0.9.9 for CVE-2026-15176) are vulnerable. For NGINX Plus, 37.0.0–37.0.4 and R33–R36 are affected. F5 recommends upgrading to Open Source 1.31.7 or 1.30.6 and to NGINX Plus 37.1.0[.]1 or 37.0.5[.]1.
Mitigations include disabling AIO or SSI for CVE-2026-97205, avoiding unnamed regex captures or restricting to named captures for CVE-2026-93479, and not using alias in location blocks or removing references to $request_filename for CVE-2026-15176, if patching cannot be immediate. Patches and related fixes are also available across associated F5 components and management tools.