NGINX: three critical flaws fixed outside the release cycle

What happened

On October 14, outside its usual schedule, F5 published a set of advisories fixing eleven NGINX vulnerabilities, three of them scored 9.2 on CVSS v4.0 and rated critical. CVE-2026-15176, the most discussed, is a heap buffer overflow triggered by crafted HTTP requests when the configuration pairs the alias directive, a rewrite, and the $request_filename variable: the worker process crashes, and code execution becomes possible where address space layout randomization (ASLR) is disabled or bypassed. Its two siblings, CVE-2026-93479 (overflow through regex captures in the map directive) and CVE-2026-97205 (use-after-free in asynchronous file I/O), follow the same pattern: no credentials needed, denial of service guaranteed, code execution depending on configuration. Distribution patches were still rolling out as this sheet was written, Ubuntu shipping USN-8955-2 on November 5. F5 reports no exploitation in the wild as of its advisories.

Why a hotel should care

NGINX fronts a large share of booking engines, hotel microsites and API gateways, often administered by an outside agency and rarely patched live. A crashing worker process is a reservation page down in peak season; code execution on the web server is a direct window onto the online till: checkout-page skimming injected into the payment form, staff session cookies stolen. Only the data plane is exposed, not the management console, but that is exactly the plane guests walk through.

Who is affected

NGINX Open Source 1.30.5 and earlier and 1.31.0 through 1.31.6, NGINX Plus R33 through R37, Ingress Controller 5.6.0 to 5.6.3, plus Gateway Fabric and Instance Manager in the ranges F5 lists. Exposure is configuration-dependent: the alias directive combined with $request_filename, unnamed regex captures in map, or async file I/O and SSI switched on. Many standard deployments use none of those patterns. The right first step is an inventory: ask the integrator, or pull from the hosting machine, the exact NGINX version and the relevant configuration blocks, property by property.

How to fix

1. Inventory NGINX servers across the estate, including microsites and booking engines hosted by providers, recording the exact version (nginx -v) and who owns update administration.
2. Upgrade to 1.30.6 or 1.31.7 for NGINX Open Source, or the fixed builds listed in F5 advisories K000162416, K000162607 and K000162608 for NGINX Plus and derivative products; for system packages, follow the distribution notice, for example USN-8955-2 on Ubuntu.
3. If no window is available immediately, apply the stopgaps: remove use of the alias directive and the $request_filename variable, switch unnamed regex captures to named captures, disable async file I/O and SSI where unused.
4. After upgrading, confirm processes restart cleanly and the error log shows no further worker segmentation.

Background

Three weeks after the original advisories, the wave of distribution backports underlines the rule of this genre: the flaw is public, the patches and the analyses are public too, and the attacker's clock runs faster than the microsite maintenance calendar. Hospitality has already seen web servers sit for months behind an available patch, until a payment incident forces the forensic review. Treat this sheet as the checklist that was missing.