F5 NGINX Plus

CVE-2026-15176 / CVE-2026-93479 / CVE-2026-97205, NGINX Open Source and NGINX Plus: three unauthenticated heap-corruption flaws rated CVSS 4.0 9.2, reachable only in specific configurations and fixed in 1.30.6 and 1.31.7

nginx's change log for 1.30.6, dated 14 October 2026, lists five security fixes, which nginx.org's advisories page ties to 1.30.6 (stable) and 1.31.7 (mainline) (nginx.org change log, 2026-10-14; nginx.org, 2026-10-14); three of them are CVE-2026-15176, a heap buffer overflow in the core module that CCB describes as reachable where a location uses alias together with rewrite and a set or return directive referencing $request_filename, or where $request_filename appears in an access-log format; CVE-2026-93479, a heap buffer overflow in script evaluation that affects configurations whose regex map captures are referenced in root or an access-log format before the map's output variable, or that use a non-cacheable variable in a string expression; and CVE-2026-97205, a use-after-free when asynchronous file I/O is enabled, which Daily CyberSecurity relays from F5 as triggered by an SSI page with include virtual commands (Centre for Cybersecurity Belgium, 2026-10-19; Daily CyberSecurity, 2026-10-14). Each is scored CVSS 4.0 9.2 and reachable by an unauthenticated network attacker, the first two under conditions beyond the attacker's control, with CCB's warning and vector covering the first two and Daily CyberSecurity all three (Centre for Cybersecurity Belgium, 2026-10-19; Daily CyberSecurity, 2026-10-14). F5's CNA text says the overflow may restart the worker process and that attackers can execute code where ASLR is disabled or can be bypassed (Debian Security Tracker, 2026-10-20). Daily CyberSecurity reports that F5 has confirmed no public proof of concept for any of the three, and no exploitation is reported (Daily CyberSecurity, 2026-10-14). Help Net Security reports that VulnCheck flagged exploitation attempts against an earlier NGINX flaw, CVE-2026-42945, three days after the flaw and its proof of concept were public (Help Net Security, 2026-05-18). The other two are CVE-2026-95101 (with HTTP/3, part of an unknown frame might be treated as the request body, bypassing client_max_body_size or injecting data into the proxied request) and CVE-2026-97629 (with TLS session ticket key rotation, one key was left uninitialised, which might allow forging a session) (nginx.org change log, 2026-10-14); nginx.org rates all five medium (nginx.org, 2026-10-14).

Builds on: F5 out-of-band patches a 15-year-old pre-auth heap overflow in nginx's script engine; credited… · CVE-2026-42945, NGINX Open Source / Plus / F5 WAF products: 18-year-old heap buffer overflow in… · CVE-2026-42530 / CVE-2026-42055, NGINX: HTTP/3 QUIC use-after-free and HTTP/2-proxy heap…

CVE-2026-42533, nginx / NGINX Plus: PCRE capture-clobber pre-auth heap overflow, researcher demonstrates RCE beyond F5's DoS-only framing (CVSS 9.2)

CVE-2026-42533 is a missing save/restore of PCRE capture state across nginx's two-pass script-expression engine. nginx evaluates a compiled expression in a LEN pass that measures the result size and a VALUE pass that writes into a buffer sized by the LEN pass, and both passes resolve capture references such as $1 by reading r->captures, a shared mutable array on the request (Stan Shaw, 2026-07-19). When a map directive using a regex pattern is evaluated between the two passes, i.e. a config where a regex capture source (location, server_name, rewrite, or if) produces captures that appear before a regex map variable in the same evaluated buffer; the map's own regex evaluation clobbers the shared capture state, so the LEN and VALUE passes disagree on the buffer size. The result is an unauthenticated, pre-auth heap buffer overflow triggerable by crafted HTTP requests, reachable from any directive that evaluates a compiled expression (proxy_set_header, fastcgi_param, return, add_header, rewrite, set, root, alias, access_log, and more). The clobber is not specific to one call site: the same LEN/VALUE pattern appears in at least 13 independent call sites across 9 source files (Stan Shaw, 2026-07-19).

The bug has existed since nginx 0.9.6 (2011, when map gained regex support). F5 (which owns nginx) shipped an out-of-band fix on 2026-07-15/16 in nginx 1.30.4 (stable) and 1.31.3 (mainline), and in NGINX Plus R36 P7 and release 37.0.3.1, rating it CVSS 4.0 9.2 (critical) / CVSS 3.1 8.1 (high) (SecurityWeek, 2026-07-16). F5's advisory frames real-world risk on ASLR-enabled systems as primarily denial-of-service, a characterization the credited discoverer directly disputes (Stan Shaw, 2026-07-19; The Hacker News, 2026-07-19). The credited discoverer, Stan Shaw, disputes the DoS-only framing and demonstrates two chainable primitives: an information-leak variant (a clobbered capture smaller than the original) that returns uninitialised heap residue (on Ubuntu 24.04 with glibc 2.39 a libc pointer at offset 0x08 and a heap pointer at 0x10, enough to defeat ASLR in one unauthenticated GET) and a heap-overflow variant (a clobbered capture larger than the original) that writes attacker-controlled request-body content past the buffer and hijacks control flow through nginx's pool-cleanup mechanism, which the original post reported at 10/10 reliability with full ASLR enabled (Stan Shaw, 2026-07-19). The revised write-up refines that figure, as the update of 2026-09-29 below records. "A reader of the F5 advisory could reasonably conclude this is DoS-only on default systems. It is not," Shaw told The Hacker News (2026-07-19).

The author held back the proof of concept and the full write-up for about three weeks after the patch and has since published both (see the update below); no in-the-wild exploitation has been reported and the CVE is not in CISA KEV. The precedent the author cites is directly relevant: CVE-2026-42945 ("Rift"), a weaker flaw in the same nginx script engine that only mattered with ASLR disabled, "saw active exploitation shortly after its PoC dropped" (Stan Shaw, 2026-07-19; Rift's confirmed in-the-wild exploitation was covered here on 2026-05-18). This bug does not require ASLR to be off, so the same trajectory should be assumed now that the PoC is public.