The facts
CVE-2026-15176 concerns alias/rewrite configurations; CVE-2026-93479 concerns map/regex handling; CVE-2026-97205 concerns asynchronous file I/O with Server Side Includes. [1][3][4][5][6]
F5’s records say code execution requires ASLR to be disabled or bypassed. These are configuration-dependent data-plane issues, not universal exposure of every NGINX installation. [4][5][6]
Fixed Ubuntu packages are 1.30.4-7ubuntu1.1 for 26.10, 1.28.3-2ubuntu1.12 for 26.04 LTS, 1.24.0-2ubuntu7.19 for 24.04 LTS, and 1.18.0-6ubuntu14.22 for 22.04 LTS. [1]
The notice also fixes HTTP/3 request injection, CVE-2026-95101, on 26.04/26.10, and SSL client-verification bypass, CVE-2026-97629, on 24.04/26.04/26.10. [1]
Still unconfirmed
- Current active exploitation of these specific flaws was not verified in the checked sources.
Sources
References support the numbered facts above. Source checks: 29 Oct 2026, 06:13 UTC.
F5-issued records establish prerequisites and module details. The event date is Canonical’s distribution-update date; the three F5 records were disclosed on 14 October. Ubuntu package numbers include distribution backports.
- USN-8955-1: nginx vulnerabilities
Canonical / Ubuntu · Primary source · 26 Oct 2026
- F5 releases out-of-band patches for critical NGINX vulnerabilities
BleepingComputer · Reporting · 19 Oct 2026
- Critical Vulnerabilities in F5 NGINX Products
Cyber Security Agency of Singapore · Primary source · 21 Oct 2026
- CVE-2026-15176: NGINX ngx_http_core_module vulnerability
F5 CNA via the CVE Program · Primary source · 14 Oct 2026
- CVE-2026-93479: NGINX map directive and regex matching vulnerability
F5 CNA via the CVE Program · Primary source · 14 Oct 2026
- CVE-2026-97205: NGINX ngx_http_core_module vulnerability
F5 CNA via the CVE Program · Primary source · 14 Oct 2026