# Multiple NGINX Vulnerabilities (CVE-2026-97205, CVE-2026-93479, CVE-2026-15176) Allow Remote Crash and Code Execution

> F5 disclosed three NGINX memory-safety flaws on 2026-10-14: a use-after-free in SSI processing with AIO and two heap buffer overflows (map regex handling, alias/rewrite handling). Each is rated CVSS v3.1 8.1 / v4.0 9.2, lets an unauthenticated remote attacker crash worker processes, and can yield code execution only where ASLR is disabled or bypassed. F5 does not report active exploitation.

- **Published:** 2026-10-14T18:32:30Z
- **Last reviewed:** 2026-10-14T18:32:30Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3534
- **ID:** TL-2026-3534
- **Severity:** HIGH (CVSS 8.1)
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 11 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-97205, CVE-2026-93479, CVE-2026-15176

## Description

On 2026-10-14 F5 published advisories K000162608, K000162607 and K000162416 for three memory-corruption vulnerabilities in NGINX Open Source and NGINX Plus. NVD published the matching CVE records the same day (status: Awaiting Analysis at time of research).

CVE-2026-97205 is a use-after-free (CWE-416) in ngx_http_core_module. When asynchronous file I/O (aio) is enabled, processing Server Side Includes pages that use 'include virtual' commands can trigger the use-after-free, causing memory corruption or worker process crashes. Cyber Security News credits the discovery to Cyberlanc3r. Affected: NGINX Open Source 1.0.0-1.30.5 and 1.31.0-1.31.6; NGINX Plus 37.0.0-37.0.4. Mitigation: disable AIO or SSI.

CVE-2026-93479 is a heap-based buffer overflow (CWE-122). It occurs when map directives with regex matching interact with root directives or access logs in specific ways, and is reachable by an unauthenticated attacker sending crafted HTTP requests. Cyber Security News credits Matt Suiche (Tolmo) and Mateusz Gierblinski. Affected: NGINX Open Source 1.30.0-1.30.5 and 1.31.2-1.31.6; NGINX Plus 37.0.0-37.0.4. Mitigation: replace unnamed regex captures with named captures.

CVE-2026-15176 is a heap-based buffer overflow (CWE-122) triggered when the alias directive is combined with rewrite and variables such as $request_filename, via crafted HTTP requests. Cyber Security News attributes discovery to F5 internally. NVD lists NGINX Open Source 0.1.29-1.30.5 and 1.31.0-1.31.6 as affected, and Cyber Security News lists 1.0.0-1.30.5 and 1.31.0-1.31.6 (the two sources differ on the lower bound). Mitigation: avoid alias directives and minimize $request_filename usage.

All three share the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1) and CVSS v4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H (9.2). The high attack complexity reflects that remote code execution requires ASLR to be disabled or bypassed; denial of service by crashing worker processes is the realistic outcome. F5 advisories do not report active exploitation, no public PoC was identified in the sources reviewed, and the three CVEs were not found in the portion of the CISA KEV catalog that could be read (first 100,000 characters only). Fixed releases: NGINX Open Source 1.30.6 / 1.31.7, NGINX Plus 37.0.5.1 / 37.1.0.1, NGINX Instance Manager 2.24.0, F5 WAF for NGINX 5.14.2 / 5.16.0, NGINX Gateway Fabric 2.8.0, NGINX Ingress Controller 5.7.0. No network IOCs (IPs/domains) exist for this vulnerability disclosure, so no BeaconBeagle correlation was applicable.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1499.004 Application or System Exploitation

## Sources

- [Multiple NGINX Flaws Let Remote Attackers Crash Servers and Execute Malicious Code](https://cybersecuritynews.com/multiple-nginx-vulnerabilities/)
- [F5 K000162608 - NGINX ngx_http_core_module vulnerability (CVE-2026-97205)](https://my.f5.com/manage/s/article/K000162608)
- [F5 K000162607 - NGINX map directive vulnerability (CVE-2026-93479)](https://my.f5.com/manage/s/article/K000162607)
- [F5 K000162416 - NGINX ngx_http_core_module vulnerability (CVE-2026-15176)](https://my.f5.com/manage/s/article/K000162416)
- [NVD - CVE-2026-97205](https://nvd.nist.gov/vuln/detail/CVE-2026-97205)
- [NVD - CVE-2026-93479](https://nvd.nist.gov/vuln/detail/CVE-2026-93479)
- [NVD - CVE-2026-15176](https://nvd.nist.gov/vuln/detail/CVE-2026-15176)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3534