Seen on exploit.in:
F5 developers have released unscheduled patches for several vulnerabilities in Nginx, including three critical issues that, under certain conditions, allow remote code execution.
The company warns that two critical bugs were discovered in ngx_http_v3_module and received identifiers CVE-2026-15176 and CVE-2026-97205, and a third vulnerability, CVE-2026-93479, is related to the map directive.
It is emphasized that all three issues affect systems with non-default configurations and are exploitable by a remote attacker without any privileges. This allows the attacker to cause a denial of service (DoS) and, in some cases, execute arbitrary code.
According to the developers, CVE-2026-15176 and CVE-2026-93479 can lead to a heap buffer overflow in the Nginx worker process, while CVE-2026-97205 triggers a use-after-free error. Exploitation of these issues leads to a crash or restart of the process. Furthermore, in all three cases, remote exploitation is possible, leading to arbitrary code execution, if address space randomization (ASLR) is disabled on the system or an attacker manages to bypass this protection.
The vulnerabilities affect several ecosystem products, including Nginx Plus, Nginx Open Source, Nginx Ingress Controller, Nginx Gateway Fabric, and Nginx Instance Manager. Patches are now available for all of them.
For users who, for whatever reason, are unable to immediately install patches, the developers offer temporary security measures:
- To protect against CVE-2026-15176, it is recommended not to use the alias directive inside the location block and the $request_filename variable;
- The risk of exploitation of CVE-2026-97205 can be mitigated by disabling AIO or Server Side Includes (SSI);
- In the case of CVE-2026-93479, it is recommended to abandon positional escapes in regular expressions and use named ones instead, and only in the configuration block where the corresponding matching is performed.
Source: exploit.in. The original article appeared in Russian at rakep.ru.
