F5 patched eleven NGINX flaws out of band, and whether three of them reach you comes down to single directives
2026-10-20Security
Three are critical at 9.2 and unauthenticated. The per-flaw workarounds are to avoid the alias directive, to disable AIO or SSI, and to use named regex captures, which tells you the real question is what is in your config.