Threat reportVulnerabilityTL-2026-3534
Multiple NGINX Vulnerabilities (CVE-2026-97205, CVE-2026-93479, CVE-2026-15176) Allow Remote Crash and Code Execution
Multiple NGINX Vulnerabilities (CVE-2026-97205 (TL-2026-3534) is a high-severity software vulnerability scored CVSS 8.1, first published 2026-10-14. It has no confirmed attribution, affects F5 NGINX Open Source, references 3 CVEs (CVE-2026-97205, CVE-2026-93479, CVE-2026-15176), maps to 4 MITRE ATT&CK techniques (T1059, T1190, T1499.004), and is covered by 9 detection rules and 11 indicators of compromise.
- CVSS
- 8.1/10High
- CVEs
- 3Referenced vulnerabilities
- Techniques
- 4MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 11Indicators of compromise
Key facts for TL-2026-3534
- Threat ID
- TL-2026-3534
- Severity
- HIGH
- CVSS
- 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- MONITORING
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, cloud, telecoms, finance, government administration
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 11
How Multiple NGINX Vulnerabilities (CVE-2026-97205 works
F5 disclosed three NGINX memory-safety flaws on 2026-10-14: a use-after-free in SSI processing with AIO and two heap buffer overflows (map regex handling, alias/rewrite handling). Each is rated CVSS v3.1 8.1 / v4.0 9.2, lets an unauthenticated remote attacker crash worker processes, and can yield code execution only where ASLR is disabled or bypassed. F5 does not report active exploitation.
On 2026-10-14 F5 published advisories K000162608, K000162607 and K000162416 for three memory-corruption vulnerabilities in NGINX Open Source and NGINX Plus. NVD published the matching CVE records the same day (status: Awaiting Analysis at time of research).
CVE-2026-97205 is a use-after-free (CWE-416) in ngx_http_core_module. When asynchronous file I/O (aio) is enabled, processing Server Side Includes pages that use 'include virtual' commands can trigger the use-after-free, causing memory corruption or worker process crashes. Cyber Security News credits the discovery to Cyberlanc3r. Affected: NGINX Open Source 1.0.0-1.30.5 and 1.31.0-1.31.6; NGINX Plus 37.0.0-37.0.4. Mitigation: disable AIO or SSI.
CVE-2026-93479 is a heap-based buffer overflow (CWE-122). It occurs when map directives with regex matching interact with root directives or access logs in specific ways, and is reachable by an unauthenticated attacker sending crafted HTTP requests. Cyber Security News credits Matt Suiche (Tolmo) and Mateusz Gierblinski. Affected: NGINX Open Source 1.30.0-1.30.5 and 1.31.2-1.31.6; NGINX Plus 37.0.0-37.0.4. Mitigation: replace unnamed regex captures with named captures.
CVE-2026-15176 is a heap-based buffer overflow (CWE-122) triggered when the alias directive is combined with rewrite and variables such as $request_filename, via crafted HTTP requests. Cyber Security News attributes discovery to F5 internally. NVD lists NGINX Open Source 0.1.29-1.30.5 and 1.31.0-1.31.6 as affected, and Cyber Security News lists 1.0.0-1.30.5 and 1.31.0-1.31.6 (the two sources differ on the lower bound). Mitigation: avoid alias directives and minimize $request_filename usage.
All three share the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1) and CVSS v4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H (9.2). The high attack complexity reflects that remote code execution requires ASLR to be disabled or bypassed; denial of service by crashing worker processes is the realistic outcome. F5 advisories do not report active exploitation, no public PoC was identified in the sources reviewed, and the three CVEs were not found in the portion of the CISA KEV catalog that could be read (first 100,000 characters only). Fixed releases: NGINX Open Source 1.30.6 / 1.31.7, NGINX Plus 37.0.5.1 / 37.1.0.1, NGINX Instance Manager 2.24.0, F5 WAF for NGINX 5.14.2 / 5.16.0, NGINX Gateway Fabric 2.8.0, NGINX Ingress Controller 5.7.0. No network IOCs (IPs/domains) exist for this vulnerability disclosure, so no BeaconBeagle correlation was applicable.
MITRE ATT&CK techniques used in TL-2026-3534
Execution
T1059 Command and Scripting Interpreter
Initial Access
T1190 Exploit Public-Facing Application
Impact
T1499.004 Application or System Exploitation
Reconnaissance
Affected products and versions in Multiple NGINX Vulnerabilities (CVE-2026-97205
- F5 — NGINX Open Source
Vulnerable versions: 1.0.0-1.30.5 (CVE-2026-97205, CVE-2026-15176; NVD lists 0.1.29-1.30.5 for CVE-2026-15176); 1.31.0-1.31.6 (CVE-2026-97205, CVE-2026-15176); 1.30.0-1.30.5 (CVE-2026-93479); 1.31.2-1.31.6 (CVE-2026-93479)
Fixed in: 1.30.6; 1.31.7 - F5 — NGINX Plus
Vulnerable versions: 37.0.0-37.0.4 (all three CVEs; NVD also lists 37.1.0, 37.0.5, R33-R36 for CVE-2026-15176)
Fixed in: 37.0.5.1; 37.1.0.1 - F5 — NGINX Instance Manager
Fixed in: 2.24.0 - F5 — F5 WAF for NGINX
Fixed in: 5.14.2; 5.16.0 - F5 — NGINX Gateway Fabric
Fixed in: 2.8.0 - F5 — NGINX Ingress Controller
Fixed in: 5.7.0
Remediation for Multiple NGINX Vulnerabilities (CVE-2026-97205
Patches
- NGINX Open Source 1.30.6 / 1.31.7
- NGINX Plus 37.0.5.1 / 37.1.0.1
- NGINX Instance Manager 2.24.0
- F5 WAF for NGINX 5.14.2 / 5.16.0
- NGINX Gateway Fabric 2.8.0
- NGINX Ingress Controller 5.7.0
Immediate actions
- Upgrade NGINX Open Source to 1.30.6 or 1.31.7 and NGINX Plus to 37.0.5.1 or 37.1.0.1
- Inventory internet-facing NGINX instances and identify configurations using aio with SSI 'include virtual', map with regex, or alias with rewrite/$request_filename
- Confirm ASLR is enabled on hosts running NGINX, since code execution requires ASLR disabled or bypassed
Workarounds
- CVE-2026-97205: disable AIO or SSI
- CVE-2026-93479: replace unnamed regex captures with named captures
- CVE-2026-15176: avoid alias directives and minimize $request_filename usage
Longer-term hardening
- Monitor NGINX worker process crash/restart rates and error-log segfault messages
- Prefer named regex captures in map directives and avoid alias where root can be used
CVEs associated with Multiple NGINX Vulnerabilities (CVE-2026-97205
Weaknesses (CWE) in Multiple NGINX Vulnerabilities (CVE-2026-97205
Timeline of Multiple NGINX Vulnerabilities (CVE-2026-97205
- Cyber Security News reported the three flaws; no active exploitation reported by F5
- NVD records last modified at 16:04 UTC; analysis status Awaiting Analysis
- F5 released fixed versions: NGINX OSS 1.30.6/1.31.7, NGINX Plus 37.0.5.1/37.1.0.1, Instance Manager 2.24.0, F5 WAF for NGINX 5.14.2/5.16.0, Gateway Fabric 2.8.0, Ingress Controller 5.7.0
- F5 advisory K000162608 and the NVD record for CVE-2026-97205 (use-after-free, SSI with AIO) published at 15:17 UTC
- F5 advisory K000162607 and the NVD record for CVE-2026-93479 (heap buffer overflow, map regex) published at 15:17 UTC
- F5 advisory K000162416 and the NVD record for CVE-2026-15176 (heap buffer overflow, alias/rewrite) published at 15:17 UTC
Sources cited for Multiple NGINX Vulnerabilities (CVE-2026-97205
- Multiple NGINX Flaws Let Remote Attackers Crash Servers and Execute Malicious Code
- F5 K000162608 - NGINX ngx_http_core_module vulnerability (CVE-2026-97205)
- F5 K000162607 - NGINX map directive vulnerability (CVE-2026-93479)
- F5 K000162416 - NGINX ngx_http_core_module vulnerability (CVE-2026-15176)
- NVD - CVE-2026-97205
- NVD - CVE-2026-93479
- NVD - CVE-2026-15176
Detection coverage for TL-2026-3534
As of 2026-10-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3534 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.