CVE-2026-15176

A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $requestfilename variable. Alternatively, the same result could be achieved when the $requestfilename variable...

CVE-2026-97629

Description When NGINX Plus or NGINX Open Source is configured with sslsessioncache shared:name:size without an explicit sslsessionticketkey file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-determinist...

K000163408: Out-of-band Security Notification (October 14, 2026)

Security Advisory Description On October 14, 2026, F5 announced the following security issues. This document is intended to serve as an index of these vulnerabilities to help determine the impact to your F5 devices. You can find the details of each issue in the associated articles. Article CVE|...

Linux Distros Unpatched Vulnerability : CVE-2026-95101

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Description NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpv3module module. When using HTTP/3 with proxyrequestbuffering on directive, an...

Linux Distros Unpatched Vulnerability : CVE-2026-15176

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return...

Linux Distros Unpatched Vulnerability : CVE-2026-93479

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the...

PT-2026-114364

Name of the Vulnerable Software and Affected Versions NGINX Plus affected versions not specified NGINX Open Source affected versions not specified Description When configured with ssl session cache shared:name:size without explicit ssl session ticket key file directives for automatic rotation of...

CVE-2026-97629: Use of Uninitialized Resource

Description When NGINX Plus or NGINX Open Source is configured with sslsessioncache shared:name:size without an explicit sslsessionticketkey file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-determinist...

PT-2026-114348

Name of the Vulnerable Software and Affected Versions NGINX Plus affected versions not specified NGINX Open Source affected versions not specified Description An issue occurs when a map directive utilizes regex matching and the root directive or access log format references the map's regex captur...

PT-2026-114355

Name of the Vulnerable Software and Affected Versions NGINX Plus affected versions not specified NGINX Open Source affected versions not specified Description A flaw exists in the ngx http v3 module module. When HTTP/3 is used in conjunction with the proxy request buffering directive set to on, a...

PT-2026-114361

Name of the Vulnerable Software and Affected Versions NGINX Plus affected versions not specified NGINX Open Source affected versions not specified Description A Use-After-Free UAF issue exists in the ngx http core module module. When asynchronous file I/O AIO is enabled in specific configurations...

CVE-2026-93479: Heap-based Buffer Overflow

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a...

CVE-2026-95101: Encoding Error

Description NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpv3module module. When using HTTP/3 with proxyrequestbuffering on directive, an unauthenticated attacker may be able to inject data in the proxied request. Impact This vulnerability may allow remote attackers to inject...

CVE-2026-97205: Use After Free

NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpcoremodule module. When asynchronous file I/O AIO is enabled in certain configurations, processing a Server Side Includes SSI page containing “include virtual” commands may trigger a Use-After-Free UAF in the NGINX worker process...

Linux Distros Unpatched Vulnerability : CVE-2026-97629

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Description When NGINX Plus or NGINX Open Source is configured with sslsessioncache shared:name:size without an explicit sslsessionticketkey file directives to...

PT-2026-114189

Name of the Vulnerable Software and Affected Versions NGINX Plus affected versions not specified NGINX Open Source affected versions not specified Description An issue exists when a location is configured using the alias directive combined with rewrite and a set or return directive that reference...

AlmaLinux 9.2 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-core / nginx-filesystem / etc (ALMALINUX9.2:CLSA-2026:1773137907)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1773137907 advisory. - A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security TLS servers. An attacker...

CentOS Linux 8.5 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-filesystem / etc (CENTOS8.5:CLSA-2026:1782979036)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1782979036 advisory. - A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security TLS servers. An attacker...

CentOS Linux 6 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-filesystem / nginx-mod-http-geoip / etc (CENTOS6:CLSA-2026:1789733488)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1789733488 advisory. - A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security TLS servers. An attacker with ...

CentOS Linux 7 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-filesystem / nginx-mod-devel / etc (CENTOS7:CLSA-2026:1785413587)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1785413587 advisory. - A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map'...