F5 patched eleven NGINX flaws out of band, and whether three of them reach you comes down to single directives

F5 published an out-of-band security notification on 14 October covering eleven NGINX vulnerabilities. Three are rated critical at CVSS 9.2: CVE-2026-15176, CVE-2026-93479 and CVE-2026-97205. The fixes are in nginx 1.31.7 mainline and 1.30.6 stable, and in NGINX Plus 37.1.0.1 and 37.0.5.1.

The affected product list is long: NGINX Plus, NGINX Open Source, NGINX Instance Manager, F5 WAF for NGINX, NGINX App Protect WAF, F5 DoS for NGINX, NGINX App Protect DoS, NGINX Gateway Fabric and NGINX Ingress Controller.

Read the workarounds first

For most advisories the workarounds are an afterthought. Here they are the most informative thing in the set, because each one names a single configuration directive.

For CVE-2026-15176, avoid the alias directive. For CVE-2026-97205, disable AIO or SSI. For CVE-2026-93479, use named regex captures.

That tells you what the advisories otherwise bury: these are not conditions of running nginx, they are conditions of running nginx a particular way. The reported impact is unauthenticated heap-based buffer overflows and use-after-free, leading to a crash, and to remote code execution only under further conditions — non-default configurations, with ASLR disabled or bypassed.

So the useful hour this week is not spent reading advisories. It is spent grepping your configuration for three directives and finding out whether any of this describes you.

That does not make the patch optional. It makes your urgency knowable, which is the thing most severity scores withhold.

Where the flaws actually live

F5's index assigns the modules, and it is worth quoting because the coverage got one wrong. CVE-2026-15176 is listed under ngx_http_core_module. BleepingComputer placed it in ngx_http_v3_module. F5's own article is the authority, and a defender who went looking in the HTTP/3 module for this one would have come back with the wrong answer about their exposure.

The rest spread across the surface: CVE-2026-97629 in the SSL module, CVE-2026-93479 in map directive and regex matching, CVE-2026-97205 in the core module again, CVE-2026-95101 in the HTTP/3 module, two in the JavaScript module, two in Gateway Fabric and two in Ingress Controller.

The Gateway Fabric and Ingress Controller entries matter disproportionately, because those are the Kubernetes-facing products. An Ingress Controller is not something an administrator configured by hand and remembers; it is something a platform team deployed from a chart, and it runs at the edge of the cluster.

Out of band is itself information

F5 has a scheduled quarterly notification cycle. This did not wait for it.

A vendor shipping eleven advisories outside its own calendar is telling you something it has not written down, and the honest reading is narrow: it means F5 judged that waiting was worse than the disruption of an unscheduled release. It does not mean exploitation, which F5 has not claimed and nobody has reported.

It does mean the usual assumption behind a maintenance window — that you can batch this with the next cycle — is the assumption the vendor just declined to make itself.

No exploitation yet

Nothing has been reported in the wild. That is the state today rather than a forecast, and the gap between a published advisory and a working exploit is the thing we watched close in one day on Plex this month.

What to do

• Patch to nginx 1.31.7 or 1.30.6, or NGINX Plus 37.1.0.1 or 37.0.5.1. That is the answer regardless of configuration.
• Before that lands, grep your configuration for alias, for aio, for ssi, and for unnamed regex captures in map blocks. That is your real exposure, and it takes minutes.
• Check what version your Ingress Controller and Gateway Fabric are running, which is not the same question as what your web servers are running and is frequently answered by a Helm chart nobody has looked at since install.
• If you run NGINX JavaScript, note that two of the eleven are in that module specifically.
• Do not take the 9.2 as a statement that code execution is likely in your deployment. It is the ceiling, and the conditions below it are narrow.

What is not established

• The precise conditions for each of the three critical flaws. F5's index points at per-CVE articles; the conditions summarised here come from reporting of those articles rather than from reading each one.
• Whether the ASLR qualifier applies to all three or to some.
• How many deployments actually use the affected directives.
• Whether any of these are being exploited. None has been reported.
• Why this release was out of band rather than scheduled. F5 does not say.