F5 has fixed 11 security defects in NGINX Plus and NGINX Open Source, according to its advisory K000163408. Three are memory-safety bugs in the NGINX worker process that F5 scores as critical: two heap buffer overflows, CVE-2026-15176 and CVE-2026-93479, and a use-after-free, CVE-2026-97205. The CVE records were published to the National Vulnerability Database (NVD) on October 14. Each bug can be reached remotely, but only on servers running particular configurations. Neither F5 nor Juniper reports exploitation in the wild of the flaws they fixed, SecurityWeek reported, and none of the three NGINX CVEs is in CISA's Known Exploited Vulnerabilities (KEV) catalog.

Juniper Networks published its own batch: 17 advisories covering more than 150 vulnerabilities in Junos OS and Junos OS Evolved, plus four flaws in Juniper Cloud-Native Router (JCNR), SecurityWeek reported on October 16.

The three NGINX bugs F5 scores as critical

Each NVD description ties the bug to specific directives or features being used together, so exposure depends on how a server is configured.

  • CVE-2026-15176: heap buffer overflow with alias and rewrite. According to the NVD record, the overflow occurs when a location uses the alias directive together with rewrite and a set or return directive that references the $request_filename variable. Using $request_filename in an access log format directive can produce the same result. nginx.org lists versions 0.1.29 through 1.31.6 as vulnerable.
  • CVE-2026-93479: heap buffer overflow in script evaluation. The NVD record describes a map directive that uses regex matching, where the root directive or the access log format references the map's regex capture variables before the map's output variable. The record adds that the same result can be achieved "by using a non-cacheable variable in a string expression under certain conditions." nginx.org lists versions 1.31.2 through 1.31.6 and 1.30.0 through 1.30.5 as vulnerable.
  • CVE-2026-97205: use-after-free in ngx_http_core_module. When asynchronous file I/O (AIO) is enabled "in certain configurations," processing a Server Side Includes (SSI) page containing include virtual commands may trigger the use-after-free, according to NVD. The result can be memory corruption or a worker process crash. nginx.org lists versions 0.8.11 through 1.31.6 as vulnerable.

For the two overflows, the NVD descriptions say an unauthenticated attacker "along with conditions beyond their control" can exploit the flaw by sending crafted HTTP requests, causing a heap buffer overflow in the worker process "leading to a restart." All three descriptions add that attackers can execute code on systems where address space layout randomization (ASLR) is disabled or can be bypassed. F5 states in each record that there is no control plane exposure and that the bugs are data plane issues only.

Two different severity ratings

F5 gives each of the three bugs a CVSS 4.0 score of 9.2 (Critical) and a CVSS 3.1 score of 8.1 (High), according to the NVD records. The nginx.org security advisories page labels the same three CVEs "medium."

The nginx.org page lists two more issues fixed in the same versions, both also rated medium: CVE-2026-95101, request body injection in HTTP/3 (vulnerable versions 1.25.0 through 1.31.6), and CVE-2026-97629, session forgery when using TLS session tickets (1.23.2 through 1.31.6). According to SecurityWeek, the remaining defects in F5's batch of 11 allow bypassing verification or validation, reading sensitive information, spoofing request attributes, injecting data into proxied requests, unbounded memory growth, and accessing protected paths before authentication.

On the open-source branches, nginx.org lists all five of these CVEs as fixed in 1.31.7 and later and in 1.30.6 and later.

Juniper: 17 advisories, about two dozen critical

About two dozen of the Juniper flaws are rated critical. According to SecurityWeek, the critical bugs can lead to:

  • code or command execution with root privileges
  • complete takeover of the device
  • kernel panics and crashes
  • a reboot of the Routing Engine and service disruption
  • off-by-one buffer overflows

SecurityWeek adds that multiple high-severity flaws in the batch could lead to remote code execution, denial of service, and other attacks.

What It Means for Defenders

  • Upgrade NGINX Open Source to 1.31.7 or 1.30.6 or later. NGINX Plus customers should use F5 advisory K000163408 to find the fixed build for their release.
  • If patching has to wait, audit configs against the conditions in the NVD records. Note that CVE-2026-93479 has a second, less specific trigger involving non-cacheable variables, and CVE-2026-97205 applies only "in certain configurations" that NVD does not fully spell out, so a config review cannot rule out exposure with certainty. Upgrading is the reliable fix.
  • Confirm ASLR is enabled on NGINX hosts. All three NVD descriptions name disabled or bypassed ASLR as the condition for code execution.
  • For Juniper, start with the critical advisories. Prioritize the root code execution and device takeover bugs, especially on devices whose management interfaces are reachable from untrusted networks, and check JCNR deployments against the four advisories for that product.
  • Do not wait for a KEV listing. Recheck the catalog before closing remediation tickets, since a later addition would set a federal deadline for agencies.

Sources