Five NGINX security flaws have been patched, but exposure depends on server configurations. Three memory-corruption vulnerabilities could potentially allow remote code execution under specific conditions.
F5 released fixes on October 14, 2026, addressing the memory flaws alongside HTTP/3 request-injection and TLS session-forgery vulnerabilities. The updates are available in NGINX Open Source versions 1.30.6 and 1.31.7, with corresponding patches for affected enterprise products.
Administrators managing web servers, reverse proxies, and Kubernetes infrastructure must check installed versions and enabled features. Configuration-dependent exposure also complicates remediation of recent NetScaler authentication vulnerabilities, where affected deployments require more than software version checks.
Five NGINX flaws and their affected configurations
The NGINX security advisories classify all five vulnerabilities as medium severity. F5, however, assigns three memory-corruption flaws critical CVSS v4.0 scores of 9.2.
| CVE | Vulnerability | Affected configuration |
|---|---|---|
| CVE-2026-15176 | Heap buffer overflow | alias and rewrite with certain uses of $request_filename |
| CVE-2026-93479 | Heap buffer overflow | Premature regex map capture references or certain non-cacheable variable expressions |
| CVE-2026-97205 | Use-after-free | Asynchronous file I/O with SSI virtual includes |
| CVE-2026-95101 | HTTP/3 request-body injection | HTTP/3 with affected proxy request buffering |
| CVE-2026-97629 | TLS session forgery | Shared TLS session cache with automatic ticket-key rotation |
The three memory-corruption vulnerabilities could crash NGINX worker processes. Remote code execution may also be possible if Address Space Layout Randomization (ASLR) is disabled or bypassed.
F5's technical advisory identifies the alias, rewrite, and $request_filename combination behind CVE-2026-15176. CVE-2026-93479 involves premature variable evaluation, while CVE-2026-97205 affects asynchronous I/O combined with Server Side Includes (SSI) using virtual includes.
The remaining vulnerabilities affect request handling and authentication. CVE-2026-95101 could forward unintended request-body data to backend applications, while CVE-2026-97629 could enable TLS session forgery and client-certificate verification bypass under specific, nondeterministic conditions. No publicly confirmed exploitation of these five vulnerabilities was identified in sources reviewed as of October 20, 2026.
Patching and reducing NGINX exposure
Administrators should upgrade NGINX Open Source to stable version 1.30.6 or mainline version 1.31.7. NGINX Plus customers should follow product-specific patch guidance, while Kubernetes operators should deploy NGINX Ingress Controller 5.7.0 or the appropriate supported long-term-support update.
Security teams should prioritize internet-facing installations and take these steps:
- Patch and verify installations: Apply supported fixes, confirm versions with
nginx -v, and check for backported patches. Previously ineffective security updates reinforce the importance of verifying remediation. - Audit vulnerable configurations: Use
nginx -Tto inspect relevantalias,rewrite,map, AIO, SSI, HTTP/3, and TLS session-cache settings. - Apply temporary mitigations: Where appropriate, disable HTTP/3 or unused SSI/AIO features, review TLS ticket settings, and correct vulnerable directive combinations.
- Restrict backend access: Limit application-server connections to authorized proxies and trusted networks.
- Monitor suspicious activity: Investigate unexpected worker crashes, unusual request-body activity, and TLS authentication anomalies. Recent WordPress RCE exploitation also illustrates the value of checking for compromise after patching.
- Test incident response plans: Validate escalation, evidence preservation, rollback procedures, and service restoration.
Configuration changes should be tested before production deployment. Patching remains the primary remediation, followed by verification that affected services and authentication mechanisms function correctly.
Related reading: Citrix also patched a critical NetScaler RCE flaw affecting specific SAML configurations, another example of why version checks must be paired with configuration assessments.