Skip to content
Today
Sections

Security Independently confirmed2 publishers 2 min read Published

F5 patches three CVSS 9.2 NGINX flaws that only certain configurations expose

F5 fixed eleven NGINX flaws, three of them critical. Each of the three depends on a specific configuration, and SecurityWeek reports that neither F5 nor Juniper mentions exploitation in the wild.

The Watch · Security desk

Send a correction

Illustration accompanying F5 patches three CVSS 9.2 NGINX flaws that only certain configurations expose
Generated illustration
Specific NGINX setups expose the critical flaws Which NGINX configurations and installs each critical flaw reaches, and when code execution may be possible, per Security Affairs.

Map of exposure. CVE-2026-15176, in NGINX Plus and Open Source, occurs with alias and $request_filename. CVE-2026-93479 affects map capture variables used before the map output variable. CVE-2026-97205 needs AIO and SSI include virtual. Code execution may be possible if ASLR is disabled or bypassed.

Specific NGINX setups expose the critical flaws
WhoHowKindClaim
alias + $request_filenameCVE-2026-15176 heap overflow occurs under configurations involving alias and $request_filenameexposure9
Map regex capture variablesCVE-2026-93479 affects configs referencing capture variables before the map output variableexposure10
AIO with SSI include virtualCVE-2026-97205 use-after-free may corrupt memory or end worker processes on SSI pagesexposure6
NGINX Plus and Open SourceCVE-2026-15176 heap overflow is in both; crafted HTTP requests could trigger denial of serviceexposure4
ASLR disabled or bypassedRemote code execution may be possible for the critical flawsconstraint7

What happened

  • CVE-2026-15176, rated CVSS 9.2, is a heap overflow that triggers under configurations pairing the alias directive with the $request_filename variable.
  • CVE-2026-97205, CVSS 9.2, is a use-after-free in ngx_http_core_module that needs AIO enabled and SSI pages with include virtual commands.
  • Eight other fixes cover verification bypass, data disclosure, spoofed request attributes, injected proxied data, unbounded memory growth and pre-authentication access to protected paths.

Why it matters

  • What it limits constraint Remote code execution needs ASLR disabled or bypassed. Where ASLR holds, the reported outcomes are denial of service and a restart.
  • Who has to decide decision With no exploitation reported, patch teams choose between ranking hosts by config match and pushing all eleven fixes everywhere at once.
  • Who's exposed exposure Both NGINX Plus and NGINX Open Source carry the two heap overflows, so commercial and community installs both need the update.
  • What it costs cost Teams that run both F5 and Juniper gear carry two patch queues in the same week.

Only one of the three criticals involves alias and $request_filename: CVE-2026-15176 [9]. CVE-2026-93479 is reached through a different path, the map directive, where regular-expression captures are referenced before the map output variable, or where a non-cacheable variable appears in a string expression [10]. A config search for alias alone would miss the second flaw.

CVE-2026-97205 differs again. It needs AIO enabled and SSI pages with include virtual commands [6]. Security Affairs describes the first two flaws as exploitable without authentication [3]. For the third it says only that a remote attacker could exploit it [6].

According to Security Affairs, the attacker also depends on conditions beyond their control, and the failure case is a buffer overflow that ends in a restart [8]. A host that matches none of the three patterns is outside the critical flaws as the reports describe them. It still needs the update for the other eight [15]. We'd patch hosts that match a pattern first and the rest on the normal cycle. Neither report lists fixed version numbers.

Juniper had the larger batch this week, SecurityWeek reported. It published 17 advisories covering more than 150 defects in Junos OS and Junos OS Evolved, plus four in Cloud-Native Router [13]. About two dozen are critical, with outcomes that include code or command execution with root privileges and complete device takeover [14].

What to watch

  • A published exploit or ASLR bypass for any of the three CVEs would change the code-execution picture.
  • Any report of exploitation of the NGINX or Juniper flaws, since both vendors' advisories currently mention none.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence68
Adoption
Not scored
Hype gap−10
Incentives
Not scored
Confidence65
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    F5 announced fixes for eleven security issues in NGINX.

    Reported Supported Source: Security AffairsView cited source
  2. [2]

    Three of the NGINX flaws F5 fixed are critical: CVE-2026-15176, CVE-2026-93479 and CVE-2026-97205.

    Reported Supported Source: Security AffairsView cited source
  3. [3]

    CVE-2026-15176 and CVE-2026-93479 could be exploited without authentication via crafted HTTP requests.

    Reported Supported Source: Security Affairs; SecurityWeek reports the sameView cited source
  4. [4]

    CVE-2026-15176 (CVSS 9.2) is a heap-based buffer overflow in NGINX Plus and NGINX Open Source that could allow an unauthenticated attacker to trigger denial of service or potentially execute arbitrary code via crafted HTTP requests.

    Reported Supported Source: Security AffairsView cited source
  5. [5]

    CVE-2026-93479 (CVSS 9.2) is a heap-based buffer overflow in NGINX Plus and NGINX Open Source that could allow an unauthenticated attacker to trigger denial of service or potentially execute arbitrary code through crafted HTTP requests.

    Reported Supported Source: Security AffairsView cited source
  6. [6]

    CVE-2026-97205 (CVSS 9.2) is a use-after-free in NGINX ngx_http_core_module that, with asynchronous file I/O (AIO) enabled, may cause memory corruption or worker process termination when processing SSI pages containing include virtual commands; a remote attacker could exploit it to cause denial of service or potentially execute code.

    Reported Supported Source: Security AffairsView cited source
  7. [7]

    For the critical flaws, remote code execution may be possible if ASLR is disabled or bypassed.

    Reported Supported Source: Security Affairs; SecurityWeek reports the sameView cited source
  8. [8]

    Under certain conditions beyond their control, an unauthenticated attacker could exploit the flaws to trigger a buffer overflow leading to a restart.

    Reported Supported Source: Security AffairsView cited source
  9. [9]

    CVE-2026-15176 occurs under specific configurations involving the alias directive and the $request_filename variable.

    Reported Supported Source: Security AffairsView cited source
  10. [10]

    CVE-2026-93479 affects specific configurations where regular-expression capture variables from the map directive are referenced before the map output variable, or where a non-cacheable variable is used in a string expression under certain conditions.

    Reported Supported Source: Security AffairsView cited source
  11. [11]

    The remaining NGINX vulnerabilities could allow attackers to bypass verification/validation, read sensitive information, spoof request attributes, inject data in proxied requests, cause unbounded memory growth, or access protected paths before authentication.

    Reported Supported Source: SecurityWeekView cited source
  12. [12]

    F5 and Juniper Networks make no mention of any of these vulnerabilities being exploited in the wild.

    Reported Supported Source: SecurityWeekView cited source
  13. [13]

    This week Juniper Networks published 17 advisories detailing over 150 security defects in Junos OS and Junos OS Evolved, and four bugs in Juniper Cloud-Native Router (JCNR).

    Reported Supported Source: SecurityWeekView cited source
  14. [14]

    Approximately two dozen of the Juniper flaws are critical-severity issues that lead to code/command execution with root privileges, complete device takeover, kernel panic, crashes, Routing Engine reboot, service disruption, and buffer overflow.

    Reported Supported Source: SecurityWeekView cited source
  15. [15]

    Eight of F5's eleven NGINX fixes are outside the three critical flaws.

    Derived Supported

Sources

2 independent publishers whose own reporting we read for this story.

  1. securityaffairs.com

    1 article · October 16, 2026

    F5 addressed critical RCE flaws in NGINX
  2. securityweek.com

    1 article · October 16, 2026

    F5, Juniper Networks Patch Critical Vulnerabilities

Topics and entities

Topics

Entities