F5’s Critical NGINX Patches Leave Kubernetes Clusters Exposed

F5 published out-of-band NGINX patches on October 14 for three memory flaws it scores 9.2 under CVSS 4.0. The Open Source project released 1.30.6 and 1.31.7 on October 14 and labeled all five of its own fixes medium.

The same F5 bulletin indexes 11 flaws, including high-severity auth bugs in NGINX Ingress Controller and Gateway Fabric. Kubernetes teams who only watch the Open Source changelog will not see those.

F5 Scores the Bugs 9.2, nginx.org Says Medium

F5 filed CVE-2026-15176, CVE-2026-93479, and CVE-2026-97205 at 8.1 on CVSS 3.1 and 9.2 on CVSS 4.0. nginx.org still lists each of those, plus two more Open Source fixes from the same day, as medium on the Open Source advisory list.

That split is the first trap. Plus customers get a critical, out-of-cycle notice. Anyone who patches from nginx.org, a distro tracker, or a container base image sees a medium item and a pair of point releases.

None of the five Open Source bugs is in CISA’s Known Exploited Vulnerabilities catalog, and F5 has not published proof-of-concept code. Health-ISAC, writing on October 19, counted 11 issues in F5’s out-of-band index and put the three memory bugs at the top of that list.

THE OCTOBER 14 OPEN SOURCE SCORES

The three 9.2 bugs crash a worker process with a heap overflow or a use-after-free. F5 says code execution is possible only when ASLR is off or an attacker can bypass it. Each one also needs a setting you turned on. Default nginx.conf is outside the blast radius. Production configs often are not.

The Alias Overflow Dates to May 2005

CVE-2026-15176 is a heap overflow in ngx_http_core_module, not in the HTTP/3 module. It fires when a location uses the alias directive, a rewrite changes the URI, and something then reads $request_filename.

nginx.org marks every build from 0.1.29 through 1.31.6 as vulnerable. Igor Sysoev shipped 0.1.29 on May 12, 2005. That is the same week SSI gained the include virtual command that shows up in a later bug in this drop.

F5 found this one internally. The worker restarts after the overflow, which looks like a crash loop on a busy proxy. Code execution is the extra case, and F5 put that condition in the advisory in plain language.

Attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.

F5, Security Advisory K000162416

Most production Linux hosts run ASLR. The crash is still a denial of service on any box that uses alias this way, and alias-plus-rewrite is a common pattern for PHP apps, static-file roots, and path remaps. If you cannot patch yet, F5 says to stop using alias in that location, or stop using $request_filename.

Map Regex and AIO Complete the Memory Trio

CVE-2026-93479 is the narrowest of the three. nginx.org lists 1.31.2 through 1.31.6 and 1.30.0 through 1.30.5. A map directive that uses regex matching overflows the heap when root or an access log references capture variables before the map’s output variable. Matt Suiche of Tolmo reported it.

CVE-2026-97205 reaches back to 0.8.11. Asynchronous file I/O is on, an SSI page uses include virtual, and the worker then touches freed memory. Shops that never enabled ssi or aio can ignore the trigger. Shops that did, including older reverse proxies still serving includes, cannot.

F5 published workarounds for teams that cannot move to 1.30.6 or 1.31.7 today.

WORKAROUNDS IF YOU CANNOT UPGRADE YET

• CVE-2026-15176: Do not use alias in the location, and do not read $request_filename in return, set, if, add_header, or the access log.
• CVE-2026-93479: Switch to named regex captures and keep those captures inside the block that holds the match.
• CVE-2026-97205: Turn aio off, or stop serving SSI pages that use include virtual.

Those knobs are the whole exploit path. A scanner that only checks the banner will not tell you if alias, map captures, or aio are live. The useful check is the config, then the binary.

Kubernetes Auth Bugs Land in the Same Bulletin

The memory trio is what the headlines used. Health-ISAC’s October 19 bulletin is the better map of who else is in the blast radius, because four of the 11 flaws sit on Kubernetes products rather than on a standalone nginx worker.

NGINX Ingress Controller 5.7 and NGINX Gateway Fabric 2.8 shipped on October 14 as feature releases, with HTTP/2 to upstreams, AccessPolicy, and health checks in the notes. They are also the security builds. Gateway Fabric 2.7.2 still bundled Open Source 1.31.6, which nginx.org lists as vulnerable. 2.8.0 bundles 1.31.7.

THE KUBERNETES FLAWS IN THE SAME DROP

• CVE-2026-94197: Health-ISAC scores this 8.7. ExternalAuth on Ingress Controller can fail open and skip authentication.
• CVE-2026-104939: Also 8.7 per Health-ISAC. Mishandled OAuth identity-provider responses can grant unauthenticated access to protected paths.
• CVE-2026-91184: F5 scores this 8.8 on CVSS 3.1 and 8.7 on CVSS 4.0. Gateway Fabric 2.4.0 through 2.7.2 leak or mis-render realm fields on a namespaced AuthenticationFilter. The fix is 2.8.0.
• CVE-2026-96615: Health-ISAC scores this 6.5. Gateway CRDs and gRPC to the NGINX Agent can expose TLS private keys across namespaces.

A platform team that treats 5.7 and 2.8 as optional feature bumps is leaving auth bypasses on the cluster edge. Those bugs do not need alias, aio, or a map capture. They need the Kubernetes objects a lot of clusters already use to put login in front of an app.

The njs engine had its own day. nginx.org shipped njs 1.0.2 on October 14 for CVE-2026-101025, a memory leak on failed xml.parse(), and CVE-2026-101019, inconsistent XML attributes that break signed-XML checks. Health-ISAC scored those 6.9 and 8.3. If you run js_content or XML filters, that package is part of the same drop.

Extra Bytes Can Reach Backends Over HTTP/3

CVE-2026-95101 lives in ngx_http_v3_module, which is the one HTTP/3 bug in this release. F5 scores it 5.3 on CVSS 3.1 and 6.9 on CVSS 4.0. With HTTP/3 and proxy_request_buffering on, which is the default, an unauthenticated client can have part of an unknown frame treated as request body.

That lets a client push past client_max_body_size or inject bytes into the request nginx proxies to a backend. F5 calls it a data-plane issue only. The control plane stays out of reach. The backend still sees extra bytes it did not ask for. Vulnerable Open Source builds run from 1.25.0 through 1.31.6. The workaround is proxy_request_buffering off.

CVE-2026-97629 is the TLS-ticket bug from the same day. nginx.org rates it medium. Automatic session-ticket key rotation can leave a key uninitialized when ssl_session_cache is shared and ssl_session_ticket_key is not loaded from a file, which can allow a forged session. F5 says the result is non-deterministic and outside the attacker’s control. Affected Open Source builds start at 1.23.2. Loading ticket keys from a file, or dropping the shared cache, closes it.

HTTP/3 is still off unless you built with –with-http_v3_module and put quic on a listen socket. That is a smaller population than alias users. It is also the population that turned the module on for a reason and may not be watching MyF5.

Plus Rx and Older 0.x Builds Have No Fix

F5’s grid for CVE-2026-15176 is the part OSS changelogs do not print. Current Plus 37.x is covered. Several older lines are not.

WHERE F5 HAS A BUILD, AND WHERE IT DOES NOT

nginx.org only ships security fixes on current stable and current mainline. A 1.28 package stays inside the vulnerable range unless a distribution backports the patch. SUSE still listed CVE-2026-95101 as pending on October 16, while openSUSE Tumbleweed had already moved to 1.31.7.

That lag is the practical problem for people who do not run Plus. The binary on a VM or in a distroless image is whatever the last package build was, and that build may still be 1.24 or 1.26. Inventory first: version, then whether the proxy is on the public internet, then whether alias, map, aio, SSI, or HTTP/3 is actually on.

CISA Already Lists Eight Exploited F5 Bugs

F5 has not flagged these NGINX issues as exploited. The company’s recent history is why out-of-band still matters. Since November 2021, CISA has listed eight F5 vulnerabilities as exploited, and four of those have been used in ransomware campaigns.

In August 2025 F5 learned that a nation-state actor had long-term access to internal systems and downloaded files from BIG-IP development systems, including source and notes on undisclosed BIG-IP bugs. The public disclosure came on October 15, 2025. CISA issued an emergency directive on F5 devices the same day. F5 says it has about 23,000 customers, including 48 of the Fortune 50.

THE YEAR THAT STILL SHAPES F5 PATCHING

1. May 12, 2005: nginx 0.1.29 ships, the first build nginx.org now lists for CVE-2026-15176.
2. August 9, 2025: F5 learns a nation-state actor had persistent access to BIG-IP development and engineering knowledge systems.
3. October 15, 2025: F5 discloses the theft. CISA issues ED 26-01 and tells federal agencies the risk is unacceptable.
4. October 14, 2026: F5 ships the out-of-band NGINX bulletin. nginx.org ships 1.30.6 and 1.31.7 the same day.

The 2025 incident does not explain these NGINX bugs. F5 said so in the disclosure, and that line is the one that belongs next to this week’s changelog.

We have no evidence that the threat actor accessed or modified the NGINX source code or product development environment, nor do we have evidence they accessed or modified our F5 Distributed Cloud Services or Silverline systems.

F5, October 2025 disclosure statement

What the theft did change is the default posture around F5 patches. Federal agencies already had an emergency order on BIG-IP. Private operators who run NGINX as a boring reverse proxy, or as Ingress, are the ones who still treat a medium nginx.org row as something that can wait for the next distro cycle. 1.30.6, 1.31.7, Ingress 5.7, and Gateway Fabric 2.8 are the builds that close this set. F5 has not reported attacks using it.

Frequently Asked Questions

Which NGINX Versions Fix the October 14 Memory Bugs?

nginx.org only ships those fixes on current stable and current mainline, so a 1.28 or 1.26 package stays vulnerable until a distribution backports the patch or you move to 1.30.6 or 1.31.7. Plus customers on 37.x need 37.0.5.1 or 37.1.0.1, and Instance Manager needs 2.24.0.

What Settings Make CVE-2026-15176 Exploitable?

The overflow needs a location that uses alias, a rewrite that changes the URI, and then a read of $request_filename through return, set, if, add_header, or the access-log format. Take any one of those three away and the path F5 described does not fire.

Why Does F5 Rate the Bugs Critical If nginx.org Says Medium?

F5’s CVSS 3.1 vector for the three memory bugs is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, so attack complexity is High even though impact is High across confidentiality, integrity, and availability. CVSS 4.0 maps that same impact to 9.2. nginx.org has used a simpler low/medium/major scale for years and put all five October 14 Open Source fixes in medium.

Does the Bulletin Also Patch NGINX Ingress Controller?

Ingress Controller 5.7 is the 5.x security release from October 14, and Gateway Fabric 2.8.0 is the matching Gateway API release. 2.7.2 still shipped Open Source 1.31.6, which is inside the vulnerable range on nginx.org, so a cluster that has not moved off 2.7.2 still has that worker.

How Can You Reduce Risk Before a Package Update Lands?

Besides the three memory-bug workarounds, set proxy_request_buffering off if you terminate HTTP/3, and load TLS session-ticket keys from a file with ssl_session_ticket_key instead of relying on automatic rotation with a shared ssl_session_cache. Those two changes close CVE-2026-95101 and CVE-2026-97629 without a new binary.