F5 Releases Out-of-Band Patches for Three Critical NGINX Vulnerabilities (CVE-2026-15176 / CVE-2026-93479 / CVE-2026-97205)

Scope: NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager

Severity: Red

F5 published an out-of-band security advisory addressing 11 NGINX vulnerabilities, three of them critical and each scoring 9.2 on CVSS. CVE-2026-15176 is a heap-based buffer overflow in NGINX’s core HTTP module tied to the alias directive and request filename handling. CVE-2026-93479 is a similar heap overflow triggered through the map directive when it uses regular expression capture variables. CVE-2026-97205 is a use-after-free condition in asynchronous file I/O handling. All three can crash a worker process, and under non-default configurations with ASLR disabled or bypassed, can potentially be escalated to remote code execution by an unauthenticated attacker. F5 has not confirmed active exploitation in the wild as of the patch release. Given how widely NGINX underpins web infrastructure globally, including a significant share of Ugandan hosting and application delivery setups, this is worth treating as a priority regardless of exploitation status. Organisations running any of the affected NGINX products must apply F5’s patches immediately; where that is not possible right away, avoid the alias directive and the request_filename variable, disable asynchronous file I/O and Server Side Includes, and switch from unnamed to named regex captures as interim mitigations.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.