Why do the scores differ?

F5 scores each flaw 9.2 under version 4.0. NGINX rates them medium under its own scale. The same flaw can score differently across scales. Scoring versions weigh attack complexity differently. Use the vendor fix list, not one number alone.

What does high attack complexity mean?

The attacker needs conditions beyond network reach. The exploit is not a simple single request. That lowers real world risk. It does not remove the risk.

ResourcesBlog

Three NGINX Memory Flaws Score 9.2: Check Your Config and Patch

F5 published an out-of-band notice on October 14, 2026. It fixes three NGINX memory flaws. Each scores 9.2 under the newest scoring version.

Leonard EserePublished 2026-10-26Reading time 5 min

Filed underNGINX F5 memory flaws flaw remediation governance

Three NGINX Memory Flaws Score 9.2: Check Your Config and Patch

Summary

F5 published out-of-band notice K000163408 on October 14, 2026.
Three NGINX memory flaws score 9.2 under CVSS version 4.0.
NGINX itself rates the same three flaws as medium severity.
All three need network access only, with no login required.
Fixed builds are NGINX Open Source 1.30.6 and 1.31.7.
No confirmed exploitation was reported through October 20, 2026.

A patch notice with a scoring split

F5 published out-of-band security notification K000163408 on October 14, 2026. It covers three memory flaws in NGINX. F5 scores each flaw 9.2 under Common Vulnerability Scoring System (CVSS) version 4.0. NGINX itself rates the same flaws as medium. That split matters for your patch order. Do not read 9.2 as a promise of easy code execution. Do not read medium as a reason to wait.

The three flaws

Common Vulnerabilities and Exposures (CVE) is the public record system. All three flaws are unauthenticated and network reachable. None needs user interaction. All three carry high attack complexity.

CVE-2026-15176 is a heap buffer overflow in the core HTTP module. It triggers when alias and rewrite directives use $request_filename.
CVE-2026-97205 is a use-after-free flaw. It needs asynchronous file input/output (AIO) with Server Side Includes (SSI) virtual includes.
CVE-2026-93479 is a heap buffer overflow. It involves premature regex map capture references and certain non-cacheable variable expressions.

What an attacker gets

The main impact is a worker process crash or restart. That is denial of service for that worker. Code execution needs Address Space Layout Randomization (ASLR) disabled or bypassed. ASLR is on by default on modern systems. Say the limit plainly: these are serious, but not simple remote shells.

Which builds are fixed

NGINX Open Source 1.30.6 is the fixed stable build. NGINX Open Source 1.31.7 is the fixed mainline build. NGINX Plus fixed builds are 37.1.0.1 and 37.0.5.1. Anything older than those builds needs the upgrade.

What about exploitation

No confirmed exploitation was reported through October 20, 2026. The Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog does not list them. That status can change fast after a public notice. Patch while the window is still open.

What to do this week

First, list every NGINX server you run, open source and Plus. Record the version on each one. Second, check configs for the three triggers above. Third, upgrade affected builds to the fixed builds. Fourth, re-scan and keep the dated result.

The governance lesson

Web servers sit at the edge of most systems. They answer strangers all day. A memory flaw there is a flaw in the front door. Config triggers make this a config story too. Your evidence file should hold five items. It should list the server inventory with versions. It should name the config triggers found. It should record the upgrade date per server. It should hold the re-scan result. An assessor can follow that file without asking twice.

Sources

F5 security notification K000163408, NGINX Open Source and NGINX Plus vulnerabilities, October 14, 2026.
CVE-2026-15176 record, CVE Program.
CVE-2026-97205 record, CVE Program.
CVE-2026-93479 record, CVE Program.
National Vulnerability Database records for the three flaws above.
Original diagram by PolicyCortex.

Next step

Want patch evidence linked to each control, without chasing spreadsheets? See how PolicyCortex collects it from live systems.

Questions on this record

Why do the scores differ?: F5 scores each flaw 9.2 under version 4.0. NGINX rates them medium under its own scale. The same flaw can score differently across scales. Scoring versions weigh attack complexity differently. Use the vendor fix list, not one number alone.
What does high attack complexity mean?: The attacker needs conditions beyond network reach. The exploit is not a simple single request. That lowers real world risk. It does not remove the risk.
Is code execution possible?: Worker crash or restart is the main impact. Code execution needs Address Space Layout Randomization (ASLR) disabled or bypassed. ASLR randomizes memory layout on modern systems. Keep it on and patch anyway.

Related records

Guides and articles describe the work. The evidence that work produces is described in three proof pages and one architecture page.

proof.state: Proof of State. What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained.
proof.change: Proof of Change. Who or what altered the environment, under what authority, with before and after state hashes.
proof.agency: Proof of Agency. What a machine was permitted to do before it acted, what it did, and what would have stopped it.
architecture: Architecture. How the chain is built and where it lives: inside your tenant, with no egress of evidence.