F5 has released out-of-band security patches to address multiple NGINX web server flaws, including three critical-severity vulnerabilities that can allow attackers to execute code on vulnerable systems. These vulnerabilities were found in the ngx_http_v3_module and the NGINX map directive. To mitigate the risks associated with these vulnerabilities, security teams and admins can take several steps. For example, to mitigate CVE-2026-15176, they should not use the 'alias' directive in a location block or the $request_filename variable. To mitigate CVE-2026-97205, they should disable asynchronous file I/O (AIO) or Server Side Includes (SSI). For CVE-2026-93479, they should use named captures instead of unnamed captures and limit their use to the block with the regex match. While F5 has not flagged these security issues as exploited in the wild, cybercrime and nation-state threat groups have often exploited vulnerabilities in F5 products. It's crucial to stay updated and patch these vulnerabilities promptly to protect your systems. In addition to these specific vulnerabilities, it's also important to ensure your overall security posture is robust, including regular password audits and maintaining up-to-date software.
