Multiple NGINX Flaws Let Remote Attackers Crash Servers and Execute Malicious Code

F5 has disclosed three serious security flaws in NGINX Plus and NGINX Open Source that can let remote, unauthenticated attackers crash worker processes by sending crafted HTTP requests. In certain setups, the memory errors could also allow code execution, although F5 says that outcome requires Address Space Layout Randomization, known as ASLR, to be disabled or bypassed. All three issues affect the NGINX data plane, which handles user traffic, rather than its control plane. The flaws are tracked as CVE-2026-97205, CVE-2026-93479, and CVE-2026-15176. F5 published the three advisories on October 14, 2026, and rated every issue High at 8.1 under CVSS v3.1 and Critical at 9.2 under CVSS v4.0. The bugs do not make every NGINX server...

Read the full article at the source.