F5 shipped fixes for eleven security defects in NGINX, three of them rated critical, and two of those expose unauthenticated heap overflows that a crafted HTTP request can reach.
The pair are tracked as CVE-2026-15176 and CVE-2026-93479, both scored 9.2. The first fires in setups that combine the alias directive with the $request_filename variable. The second lands where regex capture variables from a map directive are referenced before the map output, or a non-cacheable variable sits in a string expression.
Each can drive a buffer overflow that knocks a worker over. Turning that into remote code execution takes one more step: address randomization being switched off or dodged. Production Linux builds enable it by default, which trims the practical risk without removing it.
A third flaw revisits freed memory
The remaining critical bug, CVE-2026-97205, is a use-after-free in the core module, also scored 9.2. It surfaces when asynchronous file I/O is enabled and Server Side Includes pages carry include virtual commands, letting memory get corrupted or a worker die mid-request.
Administrators running NGINX Plus or open source builds behind a proxy tier should patch now, then grep configurations for alias and $request_filename used together. Those two lines mark the servers most likely to be picked off first. The remaining eight issues are lower severity but ship in the same release.
