NGINX Heap Buffer Overflows: F5 Issues Emergency Patches for Critical RCE and DoS Flaws

F5 Networks released emergency out-of-band security patches to address three critical vulnerabilities in its NGINX software suite. These flaws affect multiple NGINX products and could allow attackers to crash systems or execute arbitrary code, prompting immediate action from administrators.

What happened

F5 Networks disclosed three critical-severity flaws in its NGINX products, releasing emergency out-of-band patches to address them. The affected software includes NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager. According to CSO Online, the vulnerabilities are identified as CVE-2026-15176, CVE-2026-97205, and CVE-2026-93479. All three issues are rated 9.2 in severity under the latest version of the Common Vulnerability Scoring System. F5 stated that it has not found evidence of these flaws being exploited in the wild. However, the company advises customers to install or upgrade to fixed versions immediately.

The first two vulnerabilities, CVE-2026-15176 and CVE-2026-97205, reside in the ngx_http_core_module. They can cause a heap buffer overflow in the server’s worker process. This memory corruption may lead to system crashes or restarts, granting attackers access. Threat actors could also execute code on systems where Address Space Layout Randomization is disabled or bypassed. The third flaw, CVE-2026-93479, is a map directive vulnerability. It allows attackers to send crafted HTTP requests to trigger a similar heap buffer overflow. Like the others, it can lead to code execution if ASLR is not effective.

Why it matters

NGINX often serves as the front door for digital traffic, handling reverse proxying, load balancing, and Kubernetes ingress. Frank Dickson of Dickson Research noted that transport layer security usually terminates in NGINX. Code execution on such a box could expose passwords, session cookies, and API tokens in clear text. Attackers might also access private keys that establish trust for the service. These vulnerabilities follow F5’s disclosure of CVE-2026-42530 in June. That earlier flaw in the ngx_http_v3_module could also potentially allow remote attackers to cause denial of service or trigger code execution.

What to watch

• Verify which NGINX products are deployed in your environment.
• Check if Address Space Layout Randomization is enabled on servers.
• Monitor for unusual worker process crashes or restarts.
• Review HTTP request logs for crafted payloads targeting map directives.

Signals worth monitoring

Security teams should examine application logs for sudden worker process terminations that do not match scheduled maintenance. Look for spikes in HTTP error codes or unusual request patterns that might indicate crafted payloads. Network monitoring tools can reveal unexpected outbound connections from proxy servers, which often signal compromised systems. Check whether memory usage spikes precede crashes, as heap overflows can cause erratic resource consumption. Validate that logging captures full request headers to identify malicious map directive usage. Ensure alerting systems trigger on abnormal restart frequencies for critical services.

Background: Out-of-band security patches

Out-of-band patches are emergency updates released outside the regular schedule. They address severe vulnerabilities that require immediate mitigation. You apply them by validating the fix against your current build, testing in isolation, and deploying before the standard release cycle completes.

Read the full guide: How Out-of-Band Security Patches Work and When to Apply Them

What to do and how to stay safe: F5

• Inventory all NGINX instances to determine which products are affected.
• Apply the latest out-of-band security patches provided by F5 Networks.
• Verify that Address Space Layout Randomization is enabled on all servers.
• Review access logs for signs of exploitation attempts or unusual traffic patterns.

General security guidance from the Firewall Chronicle newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which NGINX products are affected by these vulnerabilities?

NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager are all impacted.

What is the severity rating of these flaws?

The three vulnerabilities are rated 9.2 in severity under CVSS version 4.0.

Is there evidence of these flaws being exploited?

F5 stated that it has not discovered evidence that these issues are being exploited in the wild.