Reported by Security Affairs. F5 has released patches for eleven security vulnerabilities affecting its NGINX products, with several critical flaws posing a significant risk to unauthenticated attackers.
Among the addressed issues are CVE-2026-15176 and CVE-2026-93479, both heap-based buffer overflow vulnerabilities with a CVSS score of 9.2. These flaws can be exploited by unauthenticated attackers through crafted HTTP requests, potentially leading to denial-of-service conditions or remote code execution if Address Space Layout Randomization (ASLR) is disabled or bypassed. The vulnerabilities are triggered under specific configurations involving the `alias` directive and the `$request_filename` variable, or when regular-expression capture variables are used in certain ways within the `map` directive. Additionally, CVE-2026-97205, a use-after-free vulnerability in the `ngx_http_core_module`, could allow for memory corruption or worker process termination when processing Server Side Includes with asynchronous file I/O enabled. These critical vulnerabilities highlight the importance of timely patching for NGINX deployments to prevent potential exploitation.
Source: Security Affairs
