NGINX releases security patches for multiple vulnerabilities

F5 has disclosed several security vulnerabilities affecting NGINX Plus and NGINX Open Source, prompting the release of urgent patches for both the mainline (1.31.7) and stable (1.30.6) branches.

Among the flaws are CVE-2026-97205, a use-after-free vulnerability in the ngx_http_core_module triggered by asynchronous file I/O and specific Server Side Includes commands, and CVE-2026-15176, a heap buffer overflow involving the alias, rewrite, and set/return directives. Notably, some of these vulnerabilities, including CVE-2026-15176 and CVE-2026-97205, reportedly date back to 2009.

Other identified issues include CVE-2026-93479, a heap buffer overflow related to the NGINX map directive and regular expression matching. While F5 rated the issues as High or Critical under certain CVSS versions, the updates are described as addressing medium-severity vulnerabilities. Because NGINX powers approximately one-third of all websites, operators are urged to upgrade immediately and move away from end-of-life versions.