F5 patches three CVSS 9.2 NGINX flaws that only certain configurations expose
F5 fixed eleven NGINX flaws, three of them critical. Each of the three depends on a specific configuration, and SecurityWeek reports that neither F5 nor Juniper mentions exploitation in the wild.
The Watch · Security desk
Map of exposure. CVE-2026-15176, in NGINX Plus and Open Source, occurs with alias and $request_filename. CVE-2026-93479 affects map capture variables used before the map output variable. CVE-2026-97205 needs AIO and SSI include virtual. Code execution may be possible if ASLR is disabled or bypassed.
- Who's exposed exposure alias + $request_filename CVE-2026-15176 heap overflow occurs under configurations involving alias and $request_filename, claim 9
- Who's exposed exposure Map regex capture variables CVE-2026-93479 affects configs referencing capture variables before the map output variable, claim 10
- Who's exposed exposure AIO with SSI include virtual CVE-2026-97205 use-after-free may corrupt memory or end worker processes on SSI pages, claim 6
- Who's exposed exposure NGINX Plus and Open Source CVE-2026-15176 heap overflow is in both; crafted HTTP requests could trigger denial of service, claim 4
- What it limits constraint ASLR disabled or bypassed Remote code execution may be possible for the critical flaws, claim 7
| Who | How | Kind | Claim |
|---|---|---|---|
| alias + $request_filename | CVE-2026-15176 heap overflow occurs under configurations involving alias and $request_filename | exposure | 9 |
| Map regex capture variables | CVE-2026-93479 affects configs referencing capture variables before the map output variable | exposure | 10 |
| AIO with SSI include virtual | CVE-2026-97205 use-after-free may corrupt memory or end worker processes on SSI pages | exposure | 6 |
| NGINX Plus and Open Source | CVE-2026-15176 heap overflow is in both; crafted HTTP requests could trigger denial of service | exposure | 4 |
| ASLR disabled or bypassed | Remote code execution may be possible for the critical flaws | constraint | 7 |
What happened
- CVE-2026-15176, rated CVSS 9.2, is a heap overflow that triggers under configurations pairing the alias directive with the $request_filename variable.
- CVE-2026-97205, CVSS 9.2, is a use-after-free in ngx_http_core_module that needs AIO enabled and SSI pages with include virtual commands.
- Eight other fixes cover verification bypass, data disclosure, spoofed request attributes, injected proxied data, unbounded memory growth and pre-authentication access to protected paths.
Why it matters
- What it limits constraint Remote code execution needs ASLR disabled or bypassed. Where ASLR holds, the reported outcomes are denial of service and a restart.
- Who has to decide decision With no exploitation reported, patch teams choose between ranking hosts by config match and pushing all eleven fixes everywhere at once.
- Who's exposed exposure Both NGINX Plus and NGINX Open Source carry the two heap overflows, so commercial and community installs both need the update.
- What it costs cost Teams that run both F5 and Juniper gear carry two patch queues in the same week.
Only one of the three criticals involves alias and $request_filename: CVE-2026-15176 [9]. CVE-2026-93479 is reached through a different path, the map directive, where regular-expression captures are referenced before the map output variable, or where a non-cacheable variable appears in a string expression [10]. A config search for alias alone would miss the second flaw.
CVE-2026-97205 differs again. It needs AIO enabled and SSI pages with include virtual commands [6]. Security Affairs describes the first two flaws as exploitable without authentication [3]. For the third it says only that a remote attacker could exploit it [6].
According to Security Affairs, the attacker also depends on conditions beyond their control, and the failure case is a buffer overflow that ends in a restart [8]. A host that matches none of the three patterns is outside the critical flaws as the reports describe them. It still needs the update for the other eight [15]. We'd patch hosts that match a pattern first and the rest on the normal cycle. Neither report lists fixed version numbers.
Juniper had the larger batch this week, SecurityWeek reported. It published 17 advisories covering more than 150 defects in Junos OS and Junos OS Evolved, plus four in Cloud-Native Router [13]. About two dozen are critical, with outcomes that include code or command execution with root privileges and complete device takeover [14].
What to watch
- A published exploit or ASLR bypass for any of the three CVEs would change the code-execution picture.
- Any report of exploitation of the NGINX or Juniper flaws, since both vendors' advisories currently mention none.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap−10
- Incentives
- Not scored
- Confidence65
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
F5 announced fixes for eleven security issues in NGINX.
- [2]
Three of the NGINX flaws F5 fixed are critical: CVE-2026-15176, CVE-2026-93479 and CVE-2026-97205.
- [3]
CVE-2026-15176 and CVE-2026-93479 could be exploited without authentication via crafted HTTP requests.
- [4]
CVE-2026-15176 (CVSS 9.2) is a heap-based buffer overflow in NGINX Plus and NGINX Open Source that could allow an unauthenticated attacker to trigger denial of service or potentially execute arbitrary code via crafted HTTP requests.
- [5]
CVE-2026-93479 (CVSS 9.2) is a heap-based buffer overflow in NGINX Plus and NGINX Open Source that could allow an unauthenticated attacker to trigger denial of service or potentially execute arbitrary code through crafted HTTP requests.
- [6]
CVE-2026-97205 (CVSS 9.2) is a use-after-free in NGINX ngx_http_core_module that, with asynchronous file I/O (AIO) enabled, may cause memory corruption or worker process termination when processing SSI pages containing include virtual commands; a remote attacker could exploit it to cause denial of service or potentially execute code.
- [7]
For the critical flaws, remote code execution may be possible if ASLR is disabled or bypassed.
- [8]
Under certain conditions beyond their control, an unauthenticated attacker could exploit the flaws to trigger a buffer overflow leading to a restart.
- [9]
CVE-2026-15176 occurs under specific configurations involving the alias directive and the $request_filename variable.
- [10]
CVE-2026-93479 affects specific configurations where regular-expression capture variables from the map directive are referenced before the map output variable, or where a non-cacheable variable is used in a string expression under certain conditions.
- [11]
The remaining NGINX vulnerabilities could allow attackers to bypass verification/validation, read sensitive information, spoof request attributes, inject data in proxied requests, cause unbounded memory growth, or access protected paths before authentication.
- [12]
F5 and Juniper Networks make no mention of any of these vulnerabilities being exploited in the wild.
- [13]
This week Juniper Networks published 17 advisories detailing over 150 security defects in Junos OS and Junos OS Evolved, and four bugs in Juniper Cloud-Native Router (JCNR).
- [14]
Approximately two dozen of the Juniper flaws are critical-severity issues that lead to code/command execution with root privileges, complete device takeover, kernel panic, crashes, Routing Engine reboot, service disruption, and buffer overflow.
- [15]
Eight of F5's eleven NGINX fixes are outside the three critical flaws.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
2 independent publishers whose own reporting we read for this story.
- securityaffairs.comF5 addressed critical RCE flaws in NGINX
1 article · October 16, 2026
- securityweek.comF5, Juniper Networks Patch Critical Vulnerabilities
1 article · October 16, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Network device securityFollow
- Web Server SecurityFollow
- Vulnerability ManagementFollow