F5 releases out-of-band patches for critical NGINX vulnerabilities

Key Points:

• F5 has issued urgent security patches for multiple NGINX web server vulnerabilities, including three critical flaws that allow remote attackers to execute code or cause denial-of-service (DoS) on affected systems.
• The critical vulnerabilities (CVE-2026-15176, CVE-2026-97205, and CVE-2026-93479) impact the ngx_http_v3_module and the NGINX map directive, potentially leading to heap-based buffer overflows or use-after-free conditions in NGINX worker processes.
• Patches cover various NGINX products such as NGINX Plus, Open Source, Ingress Controller, Gateway Fabric, and Instance Manager, with temporary mitigations available for admins unable to immediately apply updates.
• Although no exploitation in the wild has been reported yet, F5 products have a history of being targeted by cybercriminal and nation-state actors, with several vulnerabilities actively exploited since 2021, some linked to ransomware campaigns.
• F5, a major cybersecurity and application delivery provider serving thousands of global enterprises, previously disclosed a state-sponsored breach in 2025 that compromised source code and vulnerability information.