Affected Systems

NGINX Open Source, NGINX Plus, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager. Three critical CVEs: CVE-2026-15176 and CVE-2026-97205 (ngx_http_v3_module), CVE-2026-93479 (map directive). Affects non-default configurations only.

Exploitation Status

No active exploitation reported. F5 has not flagged these as exploited in the wild. However, F5 products have been historically targeted by cybercrime and nation-state actors, with 8 F5 vulnerabilities added to CISA KEV since 2021.

Business Impact

Remote code execution without authentication on NGINX systems with specific non-default configurations (HTTP/3 module enabled, alias directive or $request_filename variable in use, async file I/O or SSI enabled, or unnamed regex captures in map directive). Exploitation triggers heap-based buffer overflow or use-after-free, causing worker process crashes or enabling RCE when ASLR is disabled or bypassed. Given NGINX's widespread use as a web server and reverse proxy, successful exploitation could lead to full server compromise, data theft, or lateral movement in enterprise networks.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Immediately inventory all NGINX deployments (Open Source, Plus, Ingress Controller, Gateway Fabric, Instance Manager) and identify systems using HTTP/3 module, alias directive, $request_filename variable, async file I/O, SSI, or unnamed regex captures in map directive
  • Apply F5 out-of-band security patches to all affected NGINX products as priority; prioritize internet-facing and production systems first
  • For systems that cannot be patched immediately: disable HTTP/3 module, remove alias directive and $request_filename variable usage (CVE-2026-15176), disable async file I/O and SSI (CVE-2026-97205), or replace unnamed captures with named captures in map directive (CVE-2026-93479)
  • Monitor NGINX error logs and worker process crashes for signs of exploitation attempts; correlate with network traffic anomalies targeting HTTP/3 endpoints
  • Verify ASLR is enabled on all NGINX hosts to reduce RCE risk; review firewall rules to limit NGINX exposure to trusted sources where feasible