Skip to main content
A Singapore Government Agency Website How to identify
Official website links end with .gov.sg
Secure websites use HTTPS
Look for a lock () or https:// as an added precaution. Share sensitive information only on official, secure websites.
Government officials will never ask you to transfer money or disclose bank log-in details over a phone call.

Call the 24/7 ScamShield Helpline at 1799 if you are unsure if something is a scam.

Cyber Security Agency of Singapore
Alerts

Attackers can exploit critical vulnerabilities in F5 NGINX products to perform remote code execution or cause denial-of-service (DoS) conditions. Patch immediately.

21 October 2026

Attackers can exploit critical vulnerabilities in F5 NGINX products to perform remote code execution or cause denial-of-service (DoS) conditions. Patch immediately.

Background

F5 has released out-of-band security updates to address three critical vulnerabilities (CVE-2026-15176, CVE-2026-97205 and CVE-2026-93479) affecting NGINX products. All three vulnerabilities have a Common Vulnerability Scoring System (CVSS v4.0) score of 9.2 out of 10 each.

Impact

Successful exploitation of these vulnerabilities could result in the following:

  • CVE-2026-15176: A heap-based buffer overflow vulnerability affecting the NGINX alias and rewrite directives that could allow an unauthenticated, remote attacker to cause a worker process to crash or restart, potentially resulting in denial of service or remote code execution under certain conditions.

  • CVE-2026-97205: A use-after-free vulnerability affecting asynchronous file I/O (AIO) and Server Side Includes (SSI) that could allow an unauthenticated, remote attacker to cause memory corruption or a worker process crash, potentially resulting in denial of service or remote code execution under certain conditions.

  • CVE-2026-93479: A heap-based buffer overflow vulnerability affecting the NGINX map directive that could allow an unauthenticated, remote attacker to cause a worker process to crash or restart, potentially resulting in denial of service or remote code execution under certain conditions.

Remote code execution may be possible when Address Space Layout Randomisation (ASLR) is disabled or can be bypassed, provided the affected NGINX configuration is present.

Affected Products

The vulnerabilities affect certain versions and configurations of the following F5 NGINX products:

  • NGINX Plus releases in R33 to R37 branches

  • NGINX Open Source versions 1.30.5 and below, and 1.31.6 and below

  • NGINX Ingress Controller versions 5.6.0 through 5.6.3

  • NGINX Gateway Fabric versions 2.1.0 through 2.7.2, and versions 1.5.0 through1.6.2

  • NGINX Instance Manager versions 2.18.0 through 2.23.0

  • F5 WAF for NGINX versions 5.9.0 through 5.15.0

  • F5 DoS for NGINX versions 4.8.0 through 4.10.0

Recommendations

Users and administrators of affected products are advised to update to the latest security versions immediately. Where immediate patching is not possible, administrators should consider the following temporary mitigations:

  • CVE-2026-15176: Avoid using the alias directive within a location block or the $request_filename variable.

  • CVE-2026-97205: Disable asynchronous file I/O (AIO) or Server Side Includes (SSI).

  • CVE-2026-93479: Use named captures instead of unnamed captures and restrict their use to the configuration block containing the regular expression match.

References