F5 and NGINX patch five flaws in 1.31.7 and 1.30.6, three with reported critical scores

NGINX 1.31.7 (mainline) and 1.30.6 (stable), released on 14 October 2026, fix five vulnerabilities in the web server and reverse proxy that sits in front of a large share of the internet's sites. Five days later, on 19 October, BleepingComputer reported that F5, which maintains NGINX, had put out the fixes for three of them as "out-of-band" patches for NGINX Plus, NGINX Open Source and related products, and that the three could let a remote, unauthenticated attacker crash a worker process or, in some setups, run code. F5 says none is exploited in the wild so far, according to that report. All three need specific, non-default configurations, so whether you are exposed depends on your config files, not only on your version number.

Key points

• NGINX Open Source 1.31.7 and 1.30.6, released on 14 October 2026, fix CVE-2026-15176, CVE-2026-93479, CVE-2026-97205, CVE-2026-95101 and CVE-2026-97629.
• CVE-2026-15176 is a heap buffer overflow when the alias directive is used after a rewrite changed the request URI; the nginx.org advisory lists versions 0.1.29 through 1.31.6 as vulnerable.
• CVE-2026-93479 is a buffer overflow while evaluating string expressions with variables (document root and request logging, http and stream modules); versions 1.31.2 to 1.31.6 and 1.30.0 to 1.30.5 are listed as vulnerable.
• CVE-2026-97205 is a use-after-free with asynchronous file I/O (AIO) when an SSI page contains include virtual commands; versions 0.8.11 to 1.31.6 are listed as vulnerable.
• The nginx.org advisories page labels all five issues "medium", while BleepingComputer and Security Affairs call three of them critical and cite a score of 9.2 (Security Affairs).

What happened

On 14 October 2026 the NGINX project published 1.31.7 on the mainline branch and 1.30.6 on the stable branch. The project's changelog lists five security fixes in this release:

1. CVE-2026-15176: a buffer overflow might occur in a worker process when the alias directive is used, if the request URI was changed by the rewrite directive and was then mapped to a file path.
2. CVE-2026-93479: a buffer overflow might occur while evaluating string expressions with variables, which affected the document root calculation and request logging in the http and stream modules. The changelog thanks Matt Suiche of Tolmo Inc.
3. CVE-2026-95101: with HTTP/3, a part of an unknown frame might be treated as the request body, which might bypass the client_max_body_size limit or inject data into the proxied request. The changelog thanks Hansol Lee of GOTROOT.
4. CVE-2026-97629: with TLS session ticket key rotation, one of the keys was left uninitialised, which might allow a session to be forged. The changelog thanks PhiNode Labs.
5. CVE-2026-97205: with asynchronous file I/O, a use-after-free might occur in certain configurations if an SSI page has include virtual commands. The changelog thanks "cyberlancer".

The same release also adds MaxMind DB (MMDB) support to the GeoIP modules, lets backend SSL certificates be verified by IP address, adds reconfiguration and binary upgrade support for QUIC with the quic_bpf directive, and switches HTTP/2 to the RFC 9218 prioritisation scheme.

F5 then pushed the fixes to its commercial and Kubernetes products. According to BleepingComputer, which covered the release on 19 October, the patched products are NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric and NGINX Instance Manager. F5's advisories for the three headline bugs are K000162416 (CVE-2026-15176), K000162607 (CVE-2026-93479) and K000162608 (CVE-2026-97205). The F5 support pages did not load for us (they need JavaScript), so we relied on the nginx.org pages that link to them and on press reports for F5's scoring.

Background

NGINX has had a run of memory-safety fixes recently. The same nginx.org advisories page lists earlier ones: CVE-2026-90439, a buffer overflow in the HTTP/3 module fixed in 1.31.6 and 1.30.5; CVE-2026-42533, a buffer overflow when using map and regex, which the page rates "major" and which was fixed in 1.31.3 and 1.30.4; and CVE-2026-42530, a use-after-free in HTTP/3. Several of these cluster around the same code: HTTP/3, regular-expression captures and variable evaluation.

F5 itself is a security story too. BleepingComputer recalls that in October 2025 F5 disclosed that state-sponsored attackers had broken into its systems in August 2025 and stolen source code and information on undisclosed BIG-IP vulnerabilities, and that CISA has flagged eight F5 vulnerabilities as actively exploited since November 2021, four of them also used in ransomware attacks. That history is why admins tend to treat F5 advisories as urgent even when the default configuration is safe.

How it works: which configurations are exposed

All three headline bugs need something specific in the configuration, which is why version checks alone are not enough.

CVE	Condition	Effect (per reports)	Workaround F5 gives
CVE-2026-15176	alias in a location block combined with a rewrite, with set or return that refers to $request_filename	Heap overflow in a worker: crash, possibly code execution	Stop using alias in location blocks and stop using $request_filename
CVE-2026-93479	Regex capture variables from map used before the map's output variable, or a non-cacheable variable in a string expression	Heap overflow in a worker: crash, possibly code execution	Use named captures instead of unnamed ones and limit their use to the block with the regex match
CVE-2026-97205	AIO enabled and an SSI page that uses include virtual	Use-after-free: memory corruption or worker termination	Disable AIO or SSI

BleepingComputer reports that a successful attack causes a heap-based buffer overflow or use-after-free in the worker process, which crashes it or forces a restart, and that code execution may be possible where address space layout randomisation (ASLR) is disabled or can be bypassed. Because NGINX restarts a crashed worker, a repeated crash is mainly a denial-of-service risk: every request on that worker is dropped each time.

The scores, and why sources disagree

Severity is where the sources split, and it is worth reading carefully.

• Security Affairs, published on 16 October, lists CVE-2026-15176, CVE-2026-93479 and CVE-2026-97205 each at a score of 9.2 and says F5's advisory covers eleven NGINX issues in total. It does not say which CVSS version the 9.2 refers to.
• BleepingComputer calls the three "critical".
• The nginx.org security advisories page, by contrast, labels all five of the 14 October issues "medium", and keeps "major" for the earlier CVE-2026-42533. That page is the open-source project's own severity scale, not a CVSS score.

We could not open F5's advisories to confirm which scoring system produced the 9.2, so treat the number as F5's reported rating and the "medium" label as the open-source project's view of practical risk, which is lower because each bug needs unusual settings. Both can be true at once.

What it means

For anyone running NGINX Open Source: upgrade to 1.31.7 or 1.30.6. Distribution packages may lag, so check what your package manager's changelog says it backports rather than trusting the version string.

For Kubernetes operators: F5 lists NGINX Ingress Controller and NGINX Gateway Fabric among the patched products. Ingress controllers sit at the edge of a cluster and parse untrusted traffic, so they belong at the front of the queue. Check F5's advisory for the fixed version numbers for your product; we could not verify them.

If you cannot patch today: audit your configuration for the three patterns above. alias with rewrite and $request_filename is easy to search for, as are include virtual in SSI pages and AIO settings. Test workarounds first: disabling AIO can hurt heavily loaded file-serving, and disabling SSI changes how pages render.

For the industry: another batch of memory-corruption bugs in a C codebase that handles untrusted input keeps the argument for memory-safe components alive, though nothing in these advisories says that is how the project will respond.

What we don't know yet

• Which CVSS version and vector F5 used for the 9.2 rating, and why it differs so sharply from the project's "medium" label.
• The exact fixed version numbers for NGINX Plus and the Kubernetes products.
• Whether any exploit code exists. BleepingComputer says F5 had not flagged exploitation in the wild; that can change.
• Whether the remote code execution scenario is practical on a default modern Linux build, where ASLR is normally on.

What to watch next

• F5's advisories K000162416, K000162607 and K000162608 for scores and product fixes.
• CISA's Known Exploited Vulnerabilities catalogue, which would show if any of these start being used in attacks.
• Distribution security trackers (Debian, Ubuntu, Red Hat) for backported fixes.

Sources

• nginx.org: changes in 1.31.7, 14 October 2026 (primary)
• nginx.org: security advisories (primary)
• BleepingComputer: F5 releases out-of-band patches for critical NGINX vulnerabilities
• Security Affairs: F5 addressed critical RCE flaws in NGINX