Full Report
F5 security advisory (AV26-1049)
Analysis Summary
# Vulnerability: Multiple Vulnerabilities in NGINX and F5 NGINX-based Products
## CVE Details
- **CVE ID:** CVE-2026-101019, CVE-2026-104939, CVE-2026-15176
- **CVSS Score:** Not explicitly provided in the bulletin (F5 typically assigns High/Medium for these modules)
- **CWE:**
- CVE-2026-101019: Weakness in `ngx_http_js_module`
- CVE-2026-104939: Weakness in NGINX Ingress Controller
- CVE-2026-15176: Weakness in `ngx_http_core_module`
## Affected Systems
- **Products:**
- NGINX Gateway Fabric
- NGINX Ingress Controller
- NGINX JavaScript (njs)
- NGINX Open Source (OSS)
- NGINX Plus
- NGINX Instance Manager
- F5 WAF for NGINX (App Protect)
- F5 DoS for NGINX
- **Versions:**
- NGINX OSS: Prior to 1.30.6 and 1.31.7
- NGINX Plus: R33 through R36; prior to 37.0.5.1 and 37.1.0.1
- NGINX Ingress Controller: Prior to 5.7.0
- NGINX JavaScript: Prior to 1.0.2
- NGINX Instance Manager: Prior to 2.24.0
- F5 WAF for NGINX: Prior to 5.16.0 / 5.14.2
- F5 DoS for NGINX: Prior to 4.11.0
- **Configurations:** Systems utilizing the `ngx_http_js_module`, `ngx_http_core_module`, or running as an Ingress Controller in Kubernetes environments.
## Vulnerability Description
The advisory covers three primary technical flaws:
1. **CVE-2026-101019:** A vulnerability within the NGINX JavaScript module (`ngx_http_js_module`) that could lead to unexpected behavior or processing errors when executing JavaScript code within the NGINX pipeline.
2. **CVE-2026-104939:** A flaw specific to the NGINX Ingress Controller, potentially affecting how traffic is routed or validated within containerized environments.
3. **CVE-2026-15176:** A vulnerability in the fundamental `ngx_http_core_module`. As this is the core module for handling HTTP requests, flaws here typically involve memory corruption, request smuggling, or Denial of Service (DoS) via specially crafted HTTP headers or URIs.
## Exploitation
- **Status:** Not exploited (No reports of active exploitation in the wild as of the advisory date).
- **Complexity:** Medium (Generally requires specific configuration or knowledge of the internal module logic).
- **Attack Vector:** Network (Remote attackers can typically trigger these via crafted HTTP requests).
## Impact
- **Confidentiality:** Low to Medium (Depends on the specific module leaked data).
- **Integrity:** Medium (Potential for unauthorized modification of request processing).
- **Availability:** High (Common impact for core NGINX vulnerabilities is worker process crashes leading to DoS).
## Remediation
### Patches
Update to the following versions or later:
- **NGINX OSS:** 1.30.6 or 1.31.7
- **NGINX Plus:** 37.0.5.1 or 37.1.0.1
- **NGINX Ingress Controller:** 5.7.0
- **NGINX JavaScript:** 1.0.2
- **NGINX Instance Manager:** 2.24.0
- **F5 WAF for NGINX:** 5.16.0 or 5.14.2
- **F5 DoS for NGINX:** 4.11.0
### Workarounds
- For `ngx_http_js_module` issues: Disable or restrict the use of njs scripts in the NGINX configuration.
- For `ngx_http_core_module` issues: Implement strict request filtering at a load balancer level before traffic reaches the affected NGINX instance.
## Detection
- Monitor NGINX error logs for "worker process exited on signal" or "segmentation fault" messages.
- Use F5 Big-IP or specialized WAF signatures to detect anomalous HTTP request patterns targeting core modules.
- Audit `nginx -V` output to verify currently running versions against the vulnerable list.
## References
- hxxps://my[.]f5[.]com/manage/s/article/K000162615
- hxxps://my[.]f5[.]com/manage/s/article/K000162617
- hxxps://my[.]f5[.]com/manage/s/article/K000162416
- hxxps://www[.]cyber[.]gc[.]ca/en/alerts-advisories/f5-security-advisory-av26-1049