F5 patches five NGINX flaws in 1.30.6/1.31.7, three critical memory bugs with possible RCE; no exploitation reported

Linha do tempo

1. cert.ssi.gouv.fr ↗ · pub. 18/10/2026 21:00 · coletado 21/10 12:01

   CERT-FR: Multiple F5 NGINX product vulnerabilities allow remote code execution, denial of service and data disclosure

   ler a análise desta fonte ocultar

   CERT-FR advisory CERTFR-2026-AVI-1341, published 19 October 2026, reports multiple vulnerabilities in F5 products, mainly the NGINX family. They allow an attacker to achieve remote arbitrary code execution, remote denial of service and compromise of data confidentiality. The advisory is based on 14 October 2026 F5 security bulletins and lists 11 CVEs. It does not state exploitation status, technical root cause, IOCs or attribution.

   Technical Details

   • Impacts listed by CERT-FR: remote arbitrary code execution, remote denial of service, data confidentiality compromise, security policy bypass. The advisory does not map impacts to individual CVEs or give CVSS scores.
   • Affected: F5 DoS for NGINX 4.x before 4.11.0; F5 WAF for NGINX 5.x before 5.14.2 and 5.16.0; NGINX App Protect DoS 4.x; NGINX App Protect WAF 4.x and 5.x; NGINX Gateway Fabric before 2.8.0; NGINX Ingress Controller 2026-lts-r3 to 2026-lts-r8 and versions before 5.7.0; NGINX Instance Manager 2.x before 2.24.0; NGINX Javascript before 1.0.2; NGINX Open Source 1.31.x before 1.31.7 and versions before 1.30.6; NGINX Plus before 37.1.0.1 and 37.0.5.1.
   • F5 bulletins referenced: K000162416, K000162606 to K000162611, K000162613 to K000162615, K000162617 and K000163408.

   Remediation

   • Consult the F5 security bulletins listed above and update affected NGINX products to the fixed versions.
2. cert.ssi.gouv.fr ↗ · pub. 14/10/2026 21:00 · coletado 20/10 16:32

   CERT-FR: Multiple F5 NGINX product vulnerabilities, including remote code execution, fixed in October 2026 bulletins

   ler a análise desta fonte ocultar

   CERT-FR advisory CERTFR-2026-AVI-1317 reports multiple vulnerabilities in F5 products, mainly the NGINX family, covered by F5 security bulletins published on October 14, 2026. Some of the flaws allow an attacker to achieve remote arbitrary code execution, compromise data confidentiality and integrity, and cause remote denial of service. Five CVEs are referenced. The advisory does not state that any flaw is actively exploited, and it gives no technical details, IOCs or attribution. Defenders running NGINX Open Source, NGINX Plus or the related NGINX modules and controllers should prioritize patching.

   Technical Details

   • Affected products: F5 DoS for NGINX 4.x before 4.11.0, F5 WAF for NGINX 5.x before 5.16.0, NGINX Gateway Fabric 2.x before 2.8.0, NGINX Ingress Controller 5.x before 5.7.0, NGINX Instance Manager 2.x before 2.24.0, NGINX Open Source 1.x before 1.31.7, NGINX Plus 37.x before 37.2.0.
   • Referenced F5 bulletins: K000162416, K000162606, K000162607, K000162608 and K000162613.
   • The advisory does not map impacts to individual CVEs.

   Remediation

   • Apply the fixed versions listed in the F5 security bulletins of October 14, 2026 for every affected NGINX product.
   • Inventory NGINX deployments, including Kubernetes ingress controllers, gateways and container images, to find vulnerable builds.
3. bleepingcomputer.com ↗ · pub. 19/10/2026 10:49 · coletado 19/10 17:53

   F5 issues out-of-band patches for three critical NGINX flaws enabling DoS or code execution

   ler a análise desta fonte ocultar

   F5 released out-of-band security patches for multiple NGINX flaws, including three critical vulnerabilities: CVE-2026-15176 and CVE-2026-97205 in the ngx_http_v3_module, and CVE-2026-93479 in the NGINX map directive. Unprivileged remote attackers can exploit them against systems with non-default configurations to cause denial of service or, in some conditions, code execution. F5 has not flagged the issues as exploited in the wild, but F5 products have been frequent targets of cybercrime and nation-state actors, and CISA has listed eight F5 flaws as actively exploited since November 2021.

   Technical Details

   • Exploitation causes a heap-based buffer overflow or use-after-free in the NGINX worker process, leading to crashes or restarts.
   • Code execution is possible on systems with ASLR disabled or where the attacker can bypass ASLR.
   • Affected products include NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric and NGINX Instance Manager.
   • Context: in October 2025 F5 disclosed that state-sponsored actors breached its systems in August 2025 and stole source code and information on undisclosed BIG-IP vulnerabilities.

   Remediation

   • Install the F5 security patches.
   • CVE-2026-15176: avoid the 'alias' directive in a location block and the $request_filename variable.
   • CVE-2026-97205: disable asynchronous file I/O (AIO) or Server Side Includes (SSI).
   • CVE-2026-93479: use named captures instead of unnamed captures and limit their use to the block with the regex match.
4. thehackernews.com ↗ · pub. 15/10/2026 09:58 · coletado 19/10 17:53 primeiro registro

   NGINX patches five flaws in 1.30.6/1.31.7: three memory bugs with possible RCE, a TLS client-cert bypass and HTTP/3 smuggling

   ler a análise desta fonte ocultar

   NGINX released versions 1.30.6 (stable) and 1.31.7 (mainline) on October 14 to fix five vulnerabilities, one of which has been present in every release since May 2005. Three are memory-corruption bugs that F5 says could crash a worker process or possibly allow code execution. A fourth is a TLS session-ticket flaw that may let a forged session bypass client-certificate verification, and a fifth allows HTTP/3 request smuggling to a backend. None was in CISA's KEV catalog as of October 15, and neither NGINX nor F5 reports exploitation. F5 scores the three memory bugs 9.2 (Critical) on CVSS v4.0, the TLS flaw 8.3 and the HTTP/3 flaw 6.9, while NGINX rates all five medium. Every flaw requires a specific non-default directive or configuration to be exploitable.

   Technical Details

   • Map flaw (CVE-2026-93479): a heap overflow in string-handling code that NGINX patched in July for CVE-2026-42533. Per the fix commit, two July patches combined so that a string could outgrow its buffer. The overflow is limited to the reserved-area size on the document-root path and a single null byte on the access-log path. Affected versions start at 1.30.0 and 1.31.2, so a server patched in July is still in range. Trigger: a regex map used by root or log_format.
   • Alias flaw: after a rewrite changes the URI and before the next location is selected, anything reading $request_filename can overflow a buffer if the location prefix is longer than the rewritten URI. F5 found this flaw itself.
   • AIO flaw: an 8-bit counter of pending asynchronous operations has no overflow check. 256 operations wrap it to zero, so the request can be freed while operations still reference it (use-after-free). SSI include virtual commands running in parallel are named as the trigger (aio with ssi).
   • TLS flaw: since 1.23.2 (October 2022), a shared session cache makes NGINX rotate ticket keys itself. Rotation copies only two of three key slots, so the third holds uninitialized memory, and a ticket naming that slot can be verified and decrypted, allowing a forged session. F5 calls this non-deterministic and beyond the attacker's control, but says it could bypass client-certificate verification. Exposed setting: ssl_session_cache shared without ssl_session_ticket_key, which is the setting in NGINX's example configuration. A related earlier flaw is CVE-2025-23419 (February 2025).
   • HTTP/3 flaw: one parser field was used both for the remaining length of an unknown frame being skipped and for the DATA bytes to forward. If an unknown frame was split across two reads, the leftover count was sent to the backend as body, outside the client_max_body_size check.
   • Context: the May rewrite-module overflow CVE-2026-42945 was exploited within days of disclosure, according to VulnCheck. This is NGINX's eighth security release of 2026. F5's earlier July workaround (named captures) was questioned by researcher Stan Shaw, who said upgrading was the only complete fix.
   • NGINX also released njs 1.0.2, fixing two medium-severity XML-handling flaws (CVE-2026-101025, CVE-2026-101019).

   Remediation

   • Upgrade to 1.30.6 (stable) or 1.31.7 (mainline). Older branches such as 1.28 remain affected, and distribution packages are fixed only if the distribution has backported the patches.
   • NGINX Plus customers and users of F5 Ingress Controller, Gateway Fabric, Instance Manager and WAF should check F5 advisories. Several products had no fixed build as of October 15.
   • If you cannot upgrade, apply F5's per-flaw workarounds. Audit exposure with nginx -T, searching for alias beside rewrite, a regex map used by root or log_format, aio with ssi, listen lines with quic, and ssl_session_cache shared without ssl_session_ticket_key.
   • Credits: Matt Suiche (Tolmo) and Mateusz Gierblinski (map), Hansol Lee (GOTROOT) (HTTP/3), PhiNode Labs (TLS), Cyberlanc3r (AIO).