F5 ships out-of-band patches for critical NGINX flaws

F5 released out-of-band fixes for three critical NGINX vulnerabilities: CVE-2026-15176 and CVE-2026-97205 in ngx_http_v3_module and CVE-2026-93479 in the map directive. Unauthenticated attackers can trigger denial-of-service or code execution on non-default configurations. Patches cover NGINX Plus, Open Source, Ingress Controller, Gateway Fabric and Instance Manager.

• Three critical flaws: CVE-2026-15176, CVE-2026-97205 and CVE-2026-93479
• Exploitation causes heap buffer overflow or use-after-free in the NGINX worker process
• Code execution possible with ASLR disabled or bypassed
• F5 has not yet flagged the flaws as exploited in the wild