F5 issues emergency NGINX patches for three critical flaws
The fixes close bugs that could let remote attackers disrupt affected NGINX systems or, in some setups, run code.
F5 has issued emergency NGINX patches for three critical flaws that can lead to denial of service or, in some configurations, code execution on affected systems. The bugs are CVE-2026-15176 and CVE-2026-97205 in ngx_http_v3_module, plus CVE-2026-93479 in the NGINX map directive. The fixes cover NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager. F5 says it has not seen the issues exploited in the wild yet, and it published temporary mitigations for teams that cannot patch immediately.
Why it matters
For teams running the affected NGINX products, the issue is not just an update cycle: unpatched systems can be exposed to denial of service, and in some non-default configurations, code execution. The patches also span the main NGINX product lines, so operators across services and platforms need to check their deployments and apply the fixes or the temporary mitigations F5 published.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.
Sources
- BleepingComputer