NGINX labels October 2026 fixes medium while F5 scores them 9.2

NGINX patched three October 2026 flaws — CVE-2026-93479, CVE-2026-97205 and CVE-2026-15176 — in versions 1.31.7 and 1.30.6. The project rates them medium because they require specific configurations, while the CVE records carry CVSS v3.1 8.1 and CVSS v4.0 9.2.

• Fixes shipped in NGINX 1.31.7 and 1.30.6, plus NGINX Plus 37.1.0.1 and 37.0.5.1
• CVSS v3.1 is 8.1 and CVSS v4.0 is 9.2 despite the medium label on nginx.org
• Affected Open Source ranges include 1.31.2–1.31.6, 1.30.0–1.30.5 and branches from 0.1.29
• BIG-IP, BIG-IQ, F5OS and F5 Distributed Cloud are not affected