H-ISAC Vulnerability Bulletin TLP WHITE: F5 Releases Out-of-band Security Updates for NGINX Flaws

On October 14, 2026, F5 published an out-of-band security advisory that indexes multiple vulnerabilities affecting NGINX products and components.

Of the 11 vulnerabilities, 3 are critical (CVE-2026-15176, CVE-2026-93479, and CVE-2026-97205), all with a CVSS score of 9.2. They involve heap buffer overflows in NGINX core HTTP modules and map directive configurations, potentially allowing remote denial-of-service or code execution. The remaining 8 issues hold high or medium severity ratings.

Health-ISAC provides this information to increase situational awareness and encourage organizations to assess their risk exposure to the vulnerabilities.

Additional Info

Analysis:

F5's October 14, 2026 out-of-band advisory addresses 11 security vulnerabilities across NGINX components, led by 3 prominent vulnerabilities rated 9.2 on the CVSS scale, tracked as CVE-2026-15176, CVE-2026-93479, and CVE-2026-97205. These vulnerabilities stem from memory mismanagement in the core HTTP module and configuration handling in map directives. Remote attackers could send targeted requests that trigger worker process crashes or potentially run unauthorized code on affected deployments. The remaining nine issues pose moderate to high risks across API gateways, ingress controllers, and scripting extensions.

Below is the list of vulnerabilities included in the October 14, 2026 Out-of-Band Advisory:

• CVE-2026-15176 (CVSS: 9.2 / Critical) - Heap buffer overflow in the NGINX core HTTP module (ngx_http_core_module) involving alias and request filename processing, potentially causing denial-of-service or remote code execution.
• CVE-2026-97205 (CVSS 9.2 / Critical) - Use-after-free vulnerability in the NGINX core HTTP module (ngx_http_core_module) when AIO and Server Side Includes (include virtual) are used, which can crash worker processes or allow code execution.
• CVE-2026-93479 (CVSS: 9.2 / Critical) - Heap buffer overflow in NGINX configuration handling when the map directive uses regular expression matching and references regex capture variables.
• CVE-2026-94197 (CVSS: 8.7 / High) - Authentication and authorization bypass vulnerability in the NGINX Kubernetes Ingress Controller when configured with ExternalAuth policies.
• CVE-2026-91184 (CVSS: 8.7 / High) - Information disclosure/rendering vulnerability in NGINX Gateway Fabric when rendering the spec.basic.realm and spec.jwt.realm fields of a namespaced authentication filter.
• CVE-2026-104939 (CVSS: 8.7 / High) - Vulnerability in the NGINX Ingress Controller when implementing externalAuth policies, where mishandled OAuth IDP HTTP responses can grant unauthenticated access to protected paths.
• CVE-2026-101019 (CVSS: 8.3 / High) - Interpretation conflict vulnerability in the NGINX JavaScript (njs) XML module where entity-backed XML attributes are handled inconsistently with canonicalization rules.
• CVE-2026-97629 (CVSS: 8.1 / High) - Session forgery vulnerability in the NGINX SSL module (ngx_http_ssl_module) when ssl_session_cache is configured without explicit session ticket key rotation files, enabling client certificate verification bypass.
• CVE-2026-95101 (CVSS: 8.1 / High) - Request-processing vulnerability in the NGINX HTTP/3 module (ngx_http_v3_module).
• CVE-2026-101025 (CVSS: 6.9 (Medium) - Memory leak vulnerability in the NGINX JavaScript (njs) engine when xml.parse() fails and leaks a libxml2 parser context.
• CVE-2026-96615 (CVSS: 6.5 / Medium) - Authentication bypass/exposure vulnerability in NGINX Gateway Fabric related to Gateway CRD configurations and gRPC connections with the NGINX Agent, potentially allowing unauthorized reading of TLS private keys across namespaces.

In health sector environments, NGINX servers often serve as reverse proxies and API gateways that protect electronic health record systems, patient portals, and medical IoT devices. Process crashes can directly disrupt real-time access to clinical data and diagnostic tools. Furthermore, if threat actors achieve remote code execution, they could bypass network perimeters and access protected health information without authorization. Given the continuous operational requirements of healthcare infrastructure, even temporary system unresponsiveness poses operational and regulatory compliance risks.

View the detailed report below.