F5 releases out-of-band patches for critical NGINX vulnerabilities

F5 has pushed out unscheduled security updates covering several NGINX web server bugs, three of which carry a critical severity rating and could allow attackers to run arbitrary code. The flaws sit in the ngx_http_v3_module (CVE-2026-15176 and CVE-2026-97205) and in the NGINX map directive (CVE-2026-93479), and can be triggered remotely without authentication on instances using certain non-default configurations, resulting in a heap overflow or use-after-free in the worker process that crashes the service or, in some cases, leads to code execution if ASLR is disabled or bypassed. Fixes are now available for NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager, while F5 also lists temporary workarounds such as avoiding the 'alias' directive, disabling AIO or SSI, or switching to named regex captures. F5 says there's no evidence of active exploitation yet, but given the company's history of being a frequent target for state-sponsored and criminal hackers, organizations are urged to apply the updates promptly.