F5 Patches Critical NGINX Flaws That Enable Code Execution

F5 released out-of-band security patches for three critical NGINX vulnerabilities that enable remote code execution. The flaws affect the ngx_http_v3_module and NGINX map directive, impacting NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager. Exploitation causes heap-based buffer overflows or use-after-free conditions, potentially triggering system crashes or code execution when Address Space Layout Randomization is disabled or bypassed.

Organizations unable to patch immediately can implement mitigation strategies targeting each vulnerability: avoiding the ‘alias’ directive and $request_filename variable, disabling asynchronous file I/O or Server Side Includes, or limiting unnamed regex captures to their specific blocks. While F5 has not reported in-the-wild exploitation of these flaws, nation-state and criminal groups have frequently exploited other F5 vulnerabilities in recent years, creating urgency around patching.

F5’s customer base amplifies the impact of these vulnerabilities. The company serves over 23,000 customers, including 80 percent of the Fortune Global 500 and 48 Fortune 50 companies. CISA has tracked eight F5 vulnerabilities as actively exploited since November 2021, with four appearing in ransomware campaigns. In October 2025, F5 disclosed a breach by state-sponsored actors that occurred in August, during which attackers stole source code and information on undisclosed BIG-IP security vulnerabilities.