Full Report
F5 has released out-of-band security patches to address multiple NGINX web server flaws, including three critical-severity vulnerabilities that can let attackers execute code on vulnerable systems. [...]
Analysis Summary
# Vulnerability: Multiple Critical NGINX Flaws in ngx_http_v3_module and the map Directive (Out-of-Band F5 Patches)
## CVE Details
- **CVE IDs:**
- CVE-2026-15176 (ngx_http_v3_module)
- CVE-2026-97205 (ngx_http_v3_module)
- CVE-2026-93479 (NGINX map directive)
- **CVSS Score:** Not stated in the article. The article describes all three as critical severity. Scores should be taken from F5's advisories.
- **CWE:** Not stated. The article describes heap-based buffer overflow and use-after-free conditions, which typically map to CWE-122 and CWE-416. Confirm against vendor data.
## Affected Systems
- **Products:**
- NGINX Plus
- NGINX Open Source
- NGINX Ingress Controller
- NGINX Gateway Fabric
- NGINX Instance Manager
- **Versions:** Not specified in the article. Consult F5 advisories K000162416, K000162608, and K000162607.
- **Configurations:**
- CVE-2026-15176: Exposure depends on use of the `alias` directive in a location block or the `$request_filename` variable.
- CVE-2026-97205: Exposure depends on asynchronous file I/O (AIO) or Server Side Includes (SSI) being enabled.
- CVE-2026-93479: Exposure depends on unnamed regex captures used with the map directive.
- The article describes code execution as possible on systems with non-default configurations.
## Vulnerability Description
The flaws affect the NGINX worker process. Successful exploitation triggers a heap-based buffer overflow or a use-after-free condition, which can crash the worker or cause it to restart. The article states that code execution is possible on systems where ASLR is disabled or where an attacker can bypass ASLR. The article does not provide further technical detail on the trigger conditions.
## Exploitation
- **Status:** Not exploited (per the article, F5 has not flagged these as exploited in the wild). No PoC is mentioned.
- **Complexity:** Not stated. Code execution appears to require additional conditions, such as disabled ASLR or an ASLR bypass, which suggests higher complexity for full compromise. Denial of service is likely simpler.
- **Attack Vector:** Network. Remote attackers without privileges can exploit the flaws.
## Impact
- **Confidentiality:** Not specified. Code execution, if achieved, could expose data in the worker's memory or environment.
- **Integrity:** Potentially High. The article states that code execution is possible under specific conditions.
- **Availability:** High. Exploitation causes worker crashes and restarts, enabling denial of service.
## Remediation
### Patches
- F5 released out-of-band security patches for NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager. Specific fixed versions are not listed in the article. See the F5 advisories for version details.
### Workarounds
- **CVE-2026-15176:** Do not use the `alias` directive in a location block, and do not use the `$request_filename` variable.
- **CVE-2026-97205:** Disable asynchronous file I/O (AIO) or Server Side Includes (SSI).
- **CVE-2026-93479:** Replace unnamed captures with named captures, and limit their use to the block containing the regex match.
## Detection
- **Indicators of compromise:** The article provides none. Watch for unexpected NGINX worker crashes or restarts, error logs showing worker process termination, and unusual requests targeting HTTP/3 (QUIC) endpoints or paths that use `alias` configurations.
- **Detection methods and tools:**
- Review NGINX error logs for worker signal or segmentation fault events.
- Inventory NGINX deployments and identify configurations that use `alias`, `$request_filename`, AIO, SSI, or unnamed map captures.
- Confirm whether HTTP/3 (ngx_http_v3_module) is enabled.
- Monitor for crash loops, which may indicate exploitation attempts.
## References
- F5 advisory for CVE-2026-15176: hxxps://my[.]f5[.]com/manage/s/article/K000162416
- F5 advisory for CVE-2026-97205: hxxps://my[.]f5[.]com/manage/s/article/K000162608
- F5 advisory for CVE-2026-93479: hxxps://my[.]f5[.]com/manage/s/article/K000162607
- Source article: hxxps://www[.]bleepingcomputer[.]com/news/security/f5-releases-out-of-band-patches-for-critical-nginx-vulnerabilities/
- CISA Known Exploited Vulnerabilities Catalog (F5 entries): hxxps://www[.]cisa[.]gov/known-exploited-vulnerabilities-catalog