F5 releases out-of-band patches for critical NGINX vulnerabilities

F5 has released out-of-band security patches to address multiple NGINX web server flaws, including three critical-severity vulnerabilities that can let attackers execute code on vulnerable systems.

The three critical vulnerabilities were found in the ngx_http_v3_module (CVE-2026-15176 and CVE-2026-97205) and the NGINX map directive (CVE-2026-93479).

Remote attackers without privileges can exploit them to launch denial-of-service (DoS) attacks or gain code execution on NGINX systems with non-default configurations.

Successful exploitation causes a heap-based buffer overflow or use-after-free in the NGINX worker process, leading to crashes or a restart. However, attackers may also be able to "execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR."