F5 and the NGINX project released security fixes on October 14, 2026, addressing five vulnerabilities in NGINX Open Source and NGINX Plus. The issues affect memory handling, HTTP/3 request processing and TLS session security. Three of the vulnerabilities have been assigned a CVSS 4.0 score of 9.2 by F5, highlighting the potential impact under specific conditions.
NGINX is widely used as a web server, reverse proxy, load balancer and application traffic gateway. A vulnerability in these components can affect more than website availability: depending on the configuration and the flaw, it can also expose applications to request manipulation or compromise of a worker process.
The important distinction is that these vulnerabilities do not affect every installation in the same way. Some require particular NGINX directives or features to be enabled. Administrators should therefore assess both the installed version and the active configuration before deciding their response.
Five vulnerabilities to know
The October 14 release fixes five vulnerabilities in NGINX Open Source.
1. CVE-2026-15176 — Buffer overflow involving alias and rewrite
This vulnerability occurs when a location is configured with the alias directive alongside rewrite and a set or return directive referencing $request_filename. A similar condition can arise when the variable is used in an access-log format.
A crafted HTTP request can trigger a heap buffer overflow in an NGINX worker process, potentially causing a denial-of-service condition. Code execution may also be possible when Address Space Layout Randomization (ASLR) is disabled or can be bypassed.
F5 rates this vulnerability CVSS 4.0: 9.2 (Critical).
2. CVE-2026-93479 — Buffer overflow in script evaluation
This vulnerability affects NGINX when evaluating string expressions involving variables, particularly in configurations using regular-expression matching with the map directive.
Under the relevant conditions, an attacker can trigger a buffer overflow in the worker process. The potential consequences include service disruption and, under specific circumstances, code execution.
F5 assigns this vulnerability a CVSS 4.0 score of 9.2 (Critical).
3. CVE-2026-97205 — Use-after-free involving asynchronous file I/O
This issue affects configurations where asynchronous file I/O (AIO) is enabled and a Server Side Includes (SSI) page uses the include virtual command.
A use-after-free condition can corrupt worker-process memory when specially crafted requests trigger the vulnerable code path. This may result in a worker crash or, under specific conditions, code execution.
F5 assigns this vulnerability a CVSS 4.0 score of 9.2 (Critical). The configuration requirements are important: deployments that do not use the affected combination may not be exposed to this particular attack path.
4. CVE-2026-95101 — HTTP/3 request-body injection
This vulnerability affects the ngx_http_v3_module when HTTP/3 is enabled and the proxy_request_buffering directive is on.
An unauthenticated attacker may be able to inject data into a proxied request. Depending on how the application processes the request, this could affect request integrity and the handling of traffic forwarded to upstream services.
The reported impact is request injection rather than the memory-corruption behaviour associated with the first three vulnerabilities.
5. CVE-2026-97629 — TLS session forgery
This vulnerability concerns TLS session tickets and key rotation. A weakness in session-ticket handling can allow session forgery under the conditions described in the security advisory.
Because TLS session management is part of the security boundary between clients and services, administrators should assess this issue alongside the memory-safety and HTTP/3 flaws rather than focusing exclusively on the highest CVSS scores.
Affected and fixed versions
For NGINX Open Source, the October 14 release provides fixes for all five vulnerabilities in the following versions.
NGINX Open Source
- Stable branch: upgrade to 1.30.6 or later in that branch.
- Mainline branch: upgrade to 1.31.7 or later in that branch.
NGINX Plus
- Release 37.0: F5 lists 37.0.5.1 as a fix for the three critical memory-safety vulnerabilities.
- Release 37.1: F5 lists 37.1.0.1 as a fix for those three vulnerabilities.
Important: these NGINX Plus versions should not automatically be assumed to resolve every issue in the advisory across every branch. Confirm the exact release and fix status against the individual F5 advisory before upgrading.
Other F5 products to check
The security notification also requires administrators to assess other products that incorporate NGINX components. Depending on the product and the specific vulnerability, this includes:
- NGINX Ingress Controller
- NGINX Gateway Fabric
- NGINX Instance Manager
- F5 WAF for NGINX
- F5 DoS for NGINX
For example, F5 lists NGINX Gateway Fabric versions before 2.8.0 and NGINX Instance Manager versions before 2.24.0 as affected by at least one vulnerability in this update. NGINX Ingress Controller and the security products have their own version-specific requirements.
Do not apply the NGINX Open Source version numbers directly to these products. Check their respective F5 product advisories and supported upgrade paths.
What security teams should do now
Start with an inventory of externally exposed NGINX instances, reverse proxies, ingress controllers and application gateways. Include both self-managed installations and products supplied through vendor packages or container images.
Next, verify the exact version and review the relevant configuration. Pay particular attention to the alias, rewrite, map, AIO, SSI, HTTP/3 and TLS session-ticket settings. These checks help identify which vulnerabilities may be reachable in your environment.
Prioritise the three memory-safety vulnerabilities because of their potential for worker-process crashes and conditional code execution. However, do not leave the HTTP/3 request-injection and TLS session-forgery issues unaddressed simply because their impacts differ.
Where a patch cannot be deployed immediately, follow the mitigation instructions in the applicable F5 advisory. Configuration changes may reduce exposure, but they should not be treated as a substitute for upgrading to a fixed version.
Final takeaway
This update is a reminder that a widely deployed web-serving component can have several distinct security weaknesses discovered and fixed at the same time. The highest-risk issues involve memory corruption, but request integrity and TLS session security also deserve attention.
For security teams, the next step is straightforward: identify affected NGINX deployments, validate their configuration, confirm the appropriate fixed release and track remediation to completion.
