Five NGINX flaws fixed 14 October: nginx.org says all medium, F5's CVSS 4.0 rates three critical (read 19 Oct)

Five fixes on 14 October, a headline on 19 October, and three labels on the same flaws

nginx.org lists five security fixes released on 14 October 2026, in nginx 1.30.6 and 1.31.7, and gives each one the label "Severity: medium". BleepingComputer's report of 19 October calls three of the same five critical. That is 5 calendar days later (derived), or 4 days 23 hours 8 minutes after F5 filed the CVE records at 14:40 UTC on 14 October (derived from the record's publication time and the report's page data, 09:49 US Eastern). The nginx.org page lists 68 advisories and uses the labels medium (42), major (15), low (9), minor (1) and none (1), counted from the saved page (derived). The word critical does not appear on it.

Both labels can be traced. F5's own CVE records, published on 14 October with the scores already in them, give three of the five a CVSS 4.0 base score of 9.2, which is the critical band, and the same three 8.1, which is the high band, on CVSS 3.1. The other two score medium on 3.1. The three are CVE-2026-15176, CVE-2026-93479 and CVE-2026-97205, the same three the report names (derived from the records). So "critical" is a real number from the vendor that sells the commercial product, on one of two scales, and "medium" is the open-source project's label on a scale its page does not define. Neither tells you whether a given server is exposed, because each of the five needs a named feature or setting.

What the record does not establish: that anyone is exploiting these flaws, that a default build is affected, or what your distribution's package contains. None of the five is in the CISA Known Exploited Vulnerabilities catalogue, version 2026.10.16, released on 16 October, and CISA's own entries in the CVE records say exploitation: none as of 15 October. That is a statement about those sources on those dates. The distribution trackers, read between 19:00 and 19:20 BST on 19 October, mostly show no fix yet. F5's own advisory pages for these CVEs would not open without a browser, so this briefing reads nginx.org, the CVE records F5 filed, CISA's data and the trackers, and says where that leaves gaps.

F5 sells NGINX Plus, and nginx.org points to F5, Inc. for enterprise distributions and commercial support, so a severity word moves a customer's urgency and the vendor has a stake in it. nginx.org links each of the five entries to an F5 advisory article, so the project's label and the vendor's score sit one click apart. This site has looked at the wider problem of one flaw carrying two official scores in an earlier briefing on CVSS 3.1 and 4.0. The point here is narrower: a label is a summary of a calculation, and the calculation needs your configuration.

The five flaws and the labels on each

The table sets the labels side by side. nginx.org's column is its advisories page; the F5 column is the CVSS 3.1 then CVSS 4.0 base score in the record F5 filed as the assigner; Red Hat's column is its own page. CVSS is the Common Vulnerability Scoring System.

Labels on the five flaws fixed on 14 October 2026, read on 19 October 2026 from nginx.org, the F5 CVE records (CVE Services data) and Red Hat's CVE pages.

Flaw	nginx.org	F5 record: CVSS 3.1, then 4.0	Red Hat page
CVE-2026-15176, alias with rewrite	medium	8.1 high, then 9.2 critical	Important, 8.1
CVE-2026-93479, script evaluation (F5 says map with regex)	medium	8.1 high, then 9.2 critical	No rating shown; says it is an alias of CVE-2026-42533
CVE-2026-97205, use after free with AIO	medium	8.1 high, then 9.2 critical	Important, 8.1
CVE-2026-97629, TLS session tickets	medium	6.5 medium, then 8.3 high	6.5, marked preliminary
CVE-2026-95101, HTTP/3 request body injection	medium	5.3 medium, then 6.9 medium	5.3, marked preliminary

Counting (derived): by CVSS 4.0, three are critical, one is high and one is medium. By CVSS 3.1, none is critical, three are high and two are medium. By nginx.org, all five are medium, and its page has no critical level to give. The three that F5 scores highest carry the same base metrics under both versions: network reach, high attack complexity, no privileges, no user interaction and high impact on confidentiality, integrity and availability. Version 3.1 turns that into 8.1 and version 4.0 turns it into 9.2. F5's text for each says the attacker needs "conditions beyond their control", which is what high attack complexity encodes (inference). A diff of the saved versions of each F5 record (two or three, from the CVE List history) found no change to any score, version range or description after first publication; CISA's entry on 15 October was the only addition.

For CVE-2026-15176 alone the sources now carry seven labels: medium (nginx.org), high (F5, CVSS 3.1), critical (F5, CVSS 4.0), Important (Red Hat), important (SUSE's page), medium (Ubuntu's own priority, beside the 8.1 it shows) and critical again in the press report. Ubuntu lists priority medium for all five. Where records disagree on the weakness type, the briefing reports the disagreement: for CVE-2026-95101 F5 files CWE-172 and Red Hat's page shows CWE-444, and for CVE-2026-97629 F5 files CWE-908 and Red Hat's page shows CWE-295. NVD, the US National Vulnerability Database, shows all five as "Awaiting Analysis" on 19 October, so no independent NVD score exists yet; the scores above are F5's.

What each flaw needs, in the vendor's own words

The F5 records say what configuration each flaw needs. The wording below is condensed from the records and the nginx.org changelog, and it deliberately stops short of any configuration syntax.

What each flaw needs, from the F5 CVE records and the nginx.org changelog for 1.30.6 (14 October 2026), and the vulnerable versions on the nginx.org advisories page.

Flaw	What the F5 record says it needs	Effect the record states	Vulnerable on nginx.org
CVE-2026-15176	A location that combines alias with rewrite, then uses the mapped file name in a response or a log format.	Heap buffer overflow, worker restart. Code execution possible where ASLR is off or bypassed.	0.1.29 to 1.31.6
CVE-2026-93479	A map with regex matching whose capture variables are used in the document root or a log format before the map output; or a non-cacheable variable in a string expression under certain conditions.	Same as above.	1.31.2 to 1.31.6 and 1.30.0 to 1.30.5
CVE-2026-97205	Asynchronous file I/O (AIO) enabled in certain configurations, and a server-side includes (SSI) page with include virtual commands.	Memory corruption or worker crash. Code execution possible where ASLR is off or bypassed.	0.8.11 to 1.31.6
CVE-2026-97629	A shared TLS session cache with session tickets and no explicit ticket key file.	Forged client sessions, non-deterministically; can bypass client certificate verification.	1.23.2 to 1.31.6
CVE-2026-95101	HTTP/3 with request buffering for proxying on.	Data injected into the proxied request.	1.25.0 to 1.31.6

Counting from the module field in each F5 record (derived): one of the five needs HTTP/3, and it is the one nobody called critical. None of the three called critical is filed under the HTTP/3 module. Two of them are filed under the core module (alias with rewrite, and AIO with SSI) and the third under map with regex. From nginx.org's own module pages, read on 19 October, the defaults are: AIO off, SSI off, the session cache none, request buffering on, and alias has no default because it exists only where an administrator writes it. So "non-default" is true of the three called critical, and of the ticket flaw, and is true of the HTTP/3 flaw only in that HTTP/3 itself has to be switched on. It tells you nothing about how common each setting is in your estate. Only your own configuration files can.

The code-execution wording is conditional in all three. F5's text says "attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR". Its stated main effect is a worker process restart. Red Hat's page for CVE-2026-97205 says Red Hat systems enforce ASLR by default, which limits reliable code execution, and its page for CVE-2026-93479 calls code execution "a theoretical risk". Nothing in the records says what bypassing ASLR would take. So the critical band is a statement about the worst case the scorer assumed, not about observed attacks (inference). Whether ASLR is on is a property of the host and its kernel settings, not of NGINX, so a container does not settle it either way.

The press report, claim by claim

BleepingComputer's report is a secondary source. It names no fixed version, no release date and no nginx.org rating (derived from the saved text and a re-read at about 19:07 BST that found it unchanged). The table checks each of its claims against the primary records. "Holds" means the record supports the wording; it does not mean the claim is the whole picture.

Claims in BleepingComputer's report of 19 October 2026 (page data: 09:49 US Eastern) checked against the nginx.org pages and the F5 CVE records, read 19 October 2026.

Claim in the report	What the records say	Holds?
Three "critical-severity" flaws	F5's CVSS 4.0 scores are 9.2, critical, for exactly CVE-2026-15176, CVE-2026-93479 and CVE-2026-97205. Their CVSS 3.1 scores are 8.1, high. nginx.org rates all five medium.	On one scale only
CVE-2026-15176 and CVE-2026-97205 are in the ngx_http_v3_module	F5's records name the core module for both. nginx.org titles them alias with rewrite, and AIO. The v3 module appears in CVE-2026-95101, and in an earlier flaw, CVE-2026-90439, fixed on 15 September.	Not supported
CVE-2026-93479 is in the NGINX map directive	F5's record title and text name map with regex matching. nginx.org's advisory calls it script evaluation and names no map; its changelog says string expressions with variables.	Holds on F5's record, not in nginx.org's wording
Exploitation "on systems with non-default configurations"	Each of the five needs a named setting, as the table above shows.	Holds
Mitigations: avoid alias in a location or the file-name variable; disable AIO or SSI; use named captures	These match the workarounds in the F5 records for CVE-2026-15176, CVE-2026-97205 and CVE-2026-93479.	Holds
Patches for NGINX Ingress Controller, Gateway Fabric and Instance Manager, "affected by these two vulnerabilities"	The five records list NGINX Plus and NGINX Open Source only. F5 filed separate records the same minute for Ingress Controller and Gateway Fabric (two each). The report says "two" while naming three.	Not established
"Out-of-band" patches	The phrase appears on none of the nginx.org pages and the nginx.org blog post read. The NCSC defines out-of-band updates as released outside a vendor's published cadence. nginx.org's stable security releases fell on 13 May, 22 May, 17 June, 15 July, 15 September and 14 October (derived), and no published cadence was found. F5's own advisories could not be read.	Not verified
F5 "has not yet flagged" them as exploited	The records carry no exploitation statement. CISA's entries say none. None is in the KEV catalogue (version 2026.10.16).	Consistent, as of the read

At 14:40 UTC on 14 October, within five seconds of each other, F5 published 11 CVE records for the NGINX family (derived from the CVE List update): the five here, two for the njs scripting module, two for NGINX Ingress Controller and two for NGINX Gateway Fabric. The six others are separate flaws with separate scores and are outside this briefing, but a defender with Kubernetes ingress should read them too. GitHub release notes for Ingress Controller 5.7.0 and Gateway Fabric 2.8.0, both dated 14 October at about 11:30 UTC, do not name any of the five CVEs, so whether those products carry the fixed NGINX build was not established.

Four labels doing the work of a decision

A severity word is meant to save a reader the work of reading the record. It cannot, because every one of these five records is conditional.

Labels in the story, what each can tell a defender and what it cannot, from the sources read on 19 October 2026.

The label	What it can tell you	What it cannot
"Critical"	That F5's CVSS 4.0 calculation, for network reach, high complexity and full impact, lands in the top band.	Whether the setting it needs is in your configuration, whether anyone is exploiting it, or whether ASLR is on.
"Medium" (nginx.org)	A project label, on a scale the page does not define, applied to all five.	That you can wait. Cyber Essentials treats a CVSS v3 score of 7 or above as high risk, and F5 scores three of the five 8.1.
"Out-of-band"	A claim about F5's release timing, found only in the report.	Anything about your exposure.
"Patched"	That a fixed upstream version exists: 1.30.6 or 1.31.7.	That your package, container image or appliance carries it. On 19 October the trackers show no fix for Debian stable, Ubuntu or SUSE Linux Enterprise.

Method is separate from accusation. A vendor scoring the worst case on the newer scale, and a project calling the same flaws medium, are both doing their jobs, and the records let a reader see both. The failure would be a patching policy that read one word and skipped the record.

Patched where? What the trackers showed on 19 October

The upstream fix is two version numbers. Most estates do not run upstream builds: they run a distribution package, a container image, an ingress controller or an appliance. The table gives what each tracker said when it was read, between 19:00 and 19:20 BST on 19 October. Trackers change by the hour.

Fix status for the five flaws on distribution and vendor trackers, read 19 October 2026 between 19:00 and 19:20 BST.

Source	State shown for the five	Reading
nginx.org	Not vulnerable: 1.31.7 and later, 1.30.6 and later.	Fixed upstream on 14 October.
Debian bookworm and trixie (security)	Vulnerable: 1.22.1-9+deb12u10 and 1.26.3-3+deb13u9, for all five.	No fix shown.
Debian unstable	Fixed in 1.30.4-8, for all five.	A fix numbered below nginx.org's 1.30.6, so a lower version is not proof of a vulnerable build.
Ubuntu	Needs triage for every release listed (eight). Priority medium for all five.	Not assessed yet. It is not a statement that the flaws do not apply.
Red Hat	Important for two. For CVE-2026-15176 the page says a fix is being pursued. Treats CVE-2026-93479 as an alias of CVE-2026-42533.	No fix text for the others. Per-product state did not load without scripts.
SUSE (page for CVE-2026-15176)	Pending, important. Fixed in openSUSE Tumbleweed 1.31.7-1.1. SUSE Linux Enterprise products listed as affected.	No fix for the enterprise products shown.
nginx.org legacy lines	1.28.3 and 1.26.3 are listed as legacy downloads. They fall inside the vulnerable range of four of the five. 1.24.0 falls inside three, and 1.22.1 inside two.	No fixed release is named for any line below 1.30.

The Red Hat entry that calls CVE-2026-93479 an alias of CVE-2026-42533 deserves a flag. nginx.org lists them as separate advisories with different fixed versions: CVE-2026-42533 was fixed on 15 July in 1.30.4 and 1.31.3 and rated major, CVE-2026-93479 on 14 October in 1.30.6 and 1.31.7 and rated medium. F5's description of the October flaw reads like a variant of the July one, with the document root and log format named (inference). Whether they are one flaw, or a variant that survived the July fix, is not stated on any page read. CISA's entry for the July flaw says a proof of concept exists; its entries for the five say none. Treat the two as separate patches to confirm.

For F5's commercial NGINX Plus, the records give fixed builds only for two release lines: 37.0.5.1 and 37.1.0.1 for four of the flaws, and later builds, 37.0.7.1 and 37.2.0.1, for the HTTP/3 flaw. They list releases R33 to R36 as affected with no upper bound and no fixed version. F5's advisory articles, which should say more, would not open without a browser. The stable line has now carried security fixes in six releases in 154 days, from 13 May to 14 October (derived from the changelog), with five of its 18 security entries in the 14 October release (28 per cent, derived). A patch process that waits for a quiet month will not find one.

The UK: two clocks started on 14 October, and neither reads the severity label

The diagram draws the two UK windows to scale against the dated events. The NCSC's vulnerability management guidance, version 2.1, reviewed 1 May 2026, gives best-practice timescales and says they "apply to all updates, regardless of the vulnerability severity". Internet-facing services and software: 5 days. Operating system and applications: 7 days. Internal and air-gapped software: 14 days. Counted from the 14 October release, the five days end on Monday 19 October, the day this briefing was read (derived; the page does not say where the clock starts). The Cyber Essentials requirements for IT infrastructure v3.3 set a different number for a narrower case, below.

UK guidance and law as read on 19 October 2026 on ncsc.gov.uk, legislation.gov.uk and ico.org.uk, with where each stops. Quotations are short and exact.

UK instrument	What it says	Where it does not reach
NCSC vulnerability management guidance, version 2.1 (1 May 2026)	Update by default. Internet-facing software: 5 days, "regardless of the vulnerability severity". Principle 5: the organisation must own the risk of not updating, as "a senior-level risk decision". The page names CISA's Known Exploited Vulnerabilities Catalog as a source of information.	Guidance, not law. Does not say where the clock starts. Notes that updating by default may not apply to safety-critical systems or operational technology.
NCSC vulnerability management guidance, principle 4, triage and prioritising	A vendor advisory or scanner may give a severity rating such as CVSS, but "consider business impact and risk for your organisation". Prioritise internet-facing services. Record a fix date, and time-bound any workaround.	Gives no score threshold and no days. It is the reason a label cannot be the whole decision.
Cyber Essentials requirements for IT infrastructure v3.3 (April 2026), security update management	Updates must be installed "within 14 days" of release where the vendor calls the fix critical or high risk, or the CVSS v3 base score is 7 or above. An update that covers any such issue must be installed within 14 days.	Applies to in-scope software. F5's CVSS 3.1 score of 8.1 on three of the five brings the 14 October update inside the rule, whatever nginx.org's label (inference). The date, 28 October, is derived and counted from release.
Cyber Assessment Framework 4.0, B4.d vulnerability management	Not achieved if "You do not mitigate externally exposed vulnerabilities promptly". Achieved when announced vulnerabilities are "tracked, prioritised and mitigated" promptly.	Sets no number of days. Written around essential functions.
UK GDPR Article 32 (security of processing)	Controller and processor must implement measures giving "a level of security appropriate to the risk", including regular testing and evaluation of the measures.	Names no patch time. Two of the five touch data: client certificate checks (CVE-2026-97629) and injection into proxied requests (CVE-2026-95101).
CISA Known Exploited Vulnerabilities catalogue	US catalogue. Version 2026.10.16, released 16 October, lists none of the five and no NGINX entry at all.	Not a UK instrument, though the NCSC guidance names it. It lists exploitation seen; it is not a list of what to patch first.

The two UK documents set different numbers for the same update: 5 days for internet-facing software in the NCSC's best practice, 14 days in the Cyber Essentials requirement. Neither document keys off the project's label: the NCSC's applies to all updates, and Cyber Essentials keys off the CVSS v3 score or the vendor's own description. The ICO's data security guide, read on the same day, describes vulnerability scanning and penetration testing as ways to find weaknesses, which fits the inventory step below.

What to do, in the order worth doing

The order below follows exposure, not the label. Each item uses a source named above, and none needs the label to justify it.

What could not be verified

• F5 advisory articles. The five advisory pages that nginx.org links would not open without a browser, and this build used no browser. The F5 CVE records stand in for them. The F5 text on products other than NGINX Plus and Open Source is therefore not read.
• Ingress Controller, Gateway Fabric, Instance Manager. The report says patches exist. The five records list neither product, and no fixed versions or release dates for these products were read for these five CVEs.
• "Out-of-band". Not found in any primary page read. No published release cadence was found, so the term cannot be tested, and F5's own release schedule was not read.
• nginx-announce posts for 14 October. The public archive on nginx.org's mail server lists years to 2025 only, so the posts were not read. The nginx.org news page, changelog and F5's release blog post stand in.
• Whether CVE-2026-93479 and CVE-2026-42533 are one flaw. Red Hat says one is an alias of the other. nginx.org lists them separately with different fixed versions.
• Red Hat per-product status loads by script and was not read. Its text statements were.
• Exploitation. The sources say none as of their dates. That is not proof that none has happened since, and nothing here measures it.
• Time-stamped. Read between 18:58 and 19:20 BST on 19 October 2026. Trackers, the KEV catalogue and the report can change within hours.

The question that exposes the gap

If the label on these flaws is settled next week as medium, high or critical, which of your NGINX servers would that change the order of, and could you name them today from your configuration files rather than from a headline?

Key facts