What shipped, and when
On October 14, 2026, the NGINX project released 1.31.7 (mainline) and 1.30.6 (stable), closing five vulnerabilities. The BleepingComputer report is dated October 19, so the patches are about five days old by now. "Out-of-band" here means they were released on NGINX's own schedule, not on a regular F5 patch day.
The three headline flaws are:
- CVE-2026-15176: a buffer overflow when
aliasis used withrewrite. NGINX lists 0.1.29 through 1.31.6 as vulnerable. - CVE-2026-97205: a use-after-free involving asynchronous file I/O (AIO) and the SSI module. NGINX lists versions 0.8.11 through 1.31.6 as vulnerable.
- CVE-2026-93479: a buffer overflow in script evaluation. NGINX lists 1.30.0 through 1.30.5 and 1.31.2 through 1.31.6 as vulnerable.
All three are fixed in 1.30.6 and 1.31.7 and later. The other two CVEs in this release are CVE-2026-95101 (request body injection in HTTP/3) and CVE-2026-97629 (session forgery with TLS session ticket key rotation). Both are rated medium.
A correction on the "map directive" claim
BleepingComputer ties CVE-2026-93479 to the map directive and puts the first two CVEs in ngx_http_v3_module. NGINX's own description doesn't match that. NGINX's release notice describes CVE-2026-93479 as a buffer overflow when evaluating string expressions with variables. Its advisory page lists it as "buffer overflow in script evaluation."
The advisory page lists the buffer overflow involving map and regex as a separate flaw, CVE-2026-42533. That one was fixed back in July, in 1.30.4 and 1.31.3.
The configuration details may explain the mix-up. A third-party summary from webhosting.today says CVE-2026-93479 can be triggered when a map's regex captures are used before the map's output variable in root or a log format. It also names certain string expressions with non-cacheable variables. The map link is therefore real in some configurations, but the flaw sits in script evaluation. Treat that as a secondary reading, not NGINX's own wording.
"Critical" or "medium"?
The severity label depends on who is scoring.
- NGINX.org: its advisory page rates all five October flaws as medium. It reserves "major" for a handful of bugs, such as CVE-2026-42533 from July.
- F5 (CVE records): The CVE records, filed by F5, score three of them at 8.1 under CVSS 3.1 and 9.2 under CVSS 4.0, with high attack complexity in both.
Both ratings are defensible. The "critical" label comes from F5's CVSS 4.0 number. The upstream project's lower rating reflects how narrow the triggering configurations are. These bugs need specific, non-default setups, and the attack complexity is high.
What an attacker can actually do
The realistic worst case is a crash. For the three high-scoring flaws, memory corruption can crash a worker process, and code execution is possible where ASLR is disabled or can be bypassed. That matches the quote BleepingComputer used.
NGINX restarts crashed workers, so the effect is a burst of dropped connections. A sustained stream of crafted requests could turn that into a denial of service. Code execution is a harder problem for an attacker, since ASLR is on by default in modern Linux distributions.
Which configurations are exposed
Running a vulnerable version is not enough. Each bug needs particular features in use.
| CVE | Configuration involved | Interim mitigation |
|---|---|---|
| CVE-2026-15176 | alias with a URI changed by rewrite, and $request_filename used in set, return or an access-log format | Avoid alias in that location block, or avoid $request_filename |
| CVE-2026-97205 | AIO plus an SSI page using include virtual | Disable AIO or SSI |
| CVE-2026-93479 | Regex captures used in particular string-expression contexts | Use named captures, and limit them to the block containing the regex match |
The configuration details come from webhosting.today's summary of the CVE records. The mitigation list comes from BleepingComputer's report of F5's guidance. I couldn't confirm the exact wording of F5's advisories, so check the F5 article for each CVE before relying on a workaround. Treat any workaround as a stopgap, not a substitute for upgrading.
Which products are affected
Open Source is only part of the picture. The Canadian Centre for Cyber Security's advisory, dated October 15, lists product-level boundaries as of October 14. Products affected by one or more of the October 14 NGINX vulnerabilities are:
- NGINX Open Source: prior to 1.30.6 and 1.31.7
- NGINX Plus: prior to 37.0.5.1 and 37.1.0.1, plus versions R33 to R36
- NGINX Ingress Controller: prior to 5.7.0
- NGINX Gateway Fabric: prior to 2.8.0
- NGINX Instance Manager: prior to 2.24.0
- F5 WAF for NGINX: prior to 5.16.0 and 5.14.2
- F5 DoS for NGINX: prior to 4.11.0
- NGINX JavaScript: prior to 1.0.2
The Canadian list covers all the October 14 NGINX advisories, not only the three headline CVEs. It also includes CVE-2026-101019 and CVE-2026-104939, which are outside this story. That means not every product listed is affected by all three headline flaws. Check F5's per-CVE articles for the product you run.
The F5 products appear in this list because they build on or bundle NGINX. Securityonline.info reports fixed releases of NGINX Plus 37.1.0.1 and 37.0.5.1, and says F5's advisories show no confirmed exploitation.
Distro packages may lag
Distribution packaging adds a wrinkle. webhosting.today reports that on October 15 the Debian security tracker listed the nginx source package as fixed for all five flaws only in unstable. Stable-branch packages may still carry older versions while backports are prepared. If you install from distro repositories, check your vendor's tracker, not just the upstream version number.
Exploitation status
BleepingComputer says F5 has not flagged these issues as exploited in the wild. Securityonline.info's summary also lists no confirmed exploitation. That can change quickly. BleepingComputer notes that threat groups have often targeted F5 products, and that CISA has flagged eight F5 vulnerabilities as actively exploited since November 2021.
What to do this week
- Inventory: find every NGINX instance, including containers, ingress controllers and appliances that embed NGINX. Record the version of each.
- Check configurations: search your config files for
alias,rewrite,$request_filename,ssi on,aio, and regex captures inmapor string expressions. - Patch: move stable-branch deployments to 1.30.6 or later and mainline deployments to 1.31.7 or later. For F5 products, use the fixed versions in F5's advisories.
- Mitigate where patching must wait: apply the interim configuration changes above, then reload and test.
- Watch logs: repeated worker process crashes or unexpected restarts could point to probing. Look for them in your error logs.
The bigger picture
NGINX fixes arrive often. webhosting.today counts 26 vulnerabilities with 2026 identifiers, fixed across eight releases between February and October. Admins should expect regular NGINX upgrades. For anyone running NGINX in front of Windows-hosted applications or Azure workloads, the September and October releases are the ones to be on.