Multiple NGINX Flaws Let Remote Attackers Crash Servers and Execute Malicious Code

F5 has disclosed three serious security flaws in NGINX Plus and NGINX Open Source that can let remote, unauthenticated attackers crash worker processes by sending crafted HTTP requests.

In certain setups, the memory errors could also allow code execution, although F5 says that outcome requires Address Space Layout Randomization, known as ASLR, to be disabled or bypassed. All three issues affect the NGINX data plane, which handles user traffic, rather than its control plane.

The flaws are tracked as CVE-2026-97205, CVE-2026-93479, and CVE-2026-15176. F5 published the three advisories on October 14, 2026, and rated every issue High at 8.1 under CVSS v3.1 and Critical at 9.2 under CVSS v4.0.

The bugs do not make every NGINX server vulnerable by default because each one needs a specific software version and configuration.

Multiple NGINX Vulnerabilities

CVE-2026-97205 is a use-after-free flaw in ngx_http_core_module. It can be triggered when asynchronous file I/O, or AIO, is enabled and NGINX processes a Server Side Includes page containing an include virtual command.

The worker may keep using memory after that memory has been released, leading to memory corruption or an unexpected worker shutdown. F5 credits security researcher Cyberlanc3r with reporting the issue.

CVE-2026-93479 is a heap buffer overflow linked to the NGINX map directive and regular expression matching. The unsafe condition can appear when the root directive or an access-log format uses the map’s regex capture variables before the map output variable.

A related path involves a non-cacheable variable used in a string expression. Crafted requests can then make a worker write beyond the allocated memory area and restart. F5 credits Matt Suiche of Tolmo and Mateusz Gierblinski for coordinated disclosure.

CVE-2026-15176 is a separate heap buffer overflow in ngx_http_core_module. It affects a location block that combines alias with rewrite and a set or return directive that refers to $request_filename.

The same risk can exist when $request_filename appears in an access log_format. F5 says a remote attacker can trigger the flaw without authentication, but the required server-side conditions remain outside the attacker’s control. The company found this issue internally.

The affected range is broad. CVE-2026-97205 and CVE-2026-15176 affect NGINX Open Source 1.31.0 through 1.31.6 and 1.0.0 through 1.30.5, while the older 0.x line is also listed for CVE-2026-15176. CVE-2026-93479 has a narrower open-source range of 1.31.2 through 1.31.6 and 1.30.0 through 1.30.5. NGINX Plus 37.0.0 through 37.0.4 is affected by all three bugs.

Related products, including NGINX Instance Manager, F5 WAF for NGINX, NGINX Gateway Fabric, and some NGINX Ingress Controller releases, are also affected.

Administrators should upgrade NGINX Open Source to 1.31.7 or 1.30.6. NGINX Plus users on the 37.x line should move to 37.0.5.1 or 37.1.0.1.

Fixed releases also include NGINX Instance Manager 2.24.0, F5 WAF for NGINX 5.16.0 or 5.14.2, NGINX Gateway Fabric 2.8.0, and NGINX Ingress Controller 5.7.0. Some older branches have no update, so F5 advises moving to a supported branch that contains a fix.

Where patching cannot happen at once, configuration changes can lower the risk. For CVE-2026-97205, F5 recommends disabling either AIO or SSI. Turning off AIO may reduce performance for large static files or media streaming under heavy load, while disabling SSI stops NGINX from processing SSI tags.

For CVE-2026-93479, administrators should replace unnamed regex captures with named captures and use them only inside the matching block. For CVE-2026-15176, F5 recommends avoiding alias inside a location block and avoiding $request_filename where possible.

Teams should first run nginx -T to review the full active configuration, including included files, then compare the installed build against each advisory. After any change, nginx -t can check the syntax before the configuration is reloaded. These checks matter because the presence of an affected version alone does not prove that the needed configuration is active.

The disclosure follows several other NGINX memory-safety fixes in 2026. Cybersecurity News previously reported three NGINX flaws involving heap overflow, memory disclosure, and use-after-free conditions and an earlier group of NGINX bugs that could cause code execution or denial of service.

F5’s advisories do not report active exploitation of these three newly disclosed flaws. Still, internet-facing NGINX systems should be reviewed quickly because a successful request can restart workers and disrupt service, while a working ASLR bypass could raise the impact to code execution.

Applying the fixed release remains the strongest response because the workarounds cover only the known unsafe configuration paths.

An EDR alert reveals an attack. But can it tell the full story? Discover how to reconstruct the attack timeline.

The post Multiple NGINX Flaws Let Remote Attackers Crash Servers and Execute Malicious Code appeared first on Cyber Security News.