F5 Security Update Advisory

---

F5 has released security updates to address vulnerabilities in NGINX-related products. The affected products are NGINX Plus, NGINX Open Source, NGINX Instance Manager, F5 WAF for NGINX, NGINX App Protect WAF, F5 DoS for NGINX, NGINX App Protect DoS, NGINX Gateway Fabric, and NGINX Ingress Controller.

Resolved Vulnerabilities

---

• CVE-2026-15176: A heap-based buffer overflow vulnerability in NGINX products.
• CVE-2026-93479. A heap-based buffer overflow vulnerability in NGINX products.
• CVE-2026-95101. An encoding error vulnerability in NGINX products.
• CVE-2026-97205. A use-after-free vulnerability (a vulnerability where memory that has been freed is accessed again) in NGINX products.
• CVE-2026-97629. An uninitialized resource usage vulnerability in NGINX products.

Action Required

---

Vulnerability Patches have been released in the latest updates. Follow the instructions on the reference site to update each product to the latest version with the Vulnerability Patches.

Vulnerability Patch Versions

---

• Patch versions addressing CVE-2026-15176, CVE-2026-93479, and CVE-2026-97205 are NGINX Plus 37.0.5.1, 37.1.0.1, NGINX Open Source 1.31.7, 1.30.6, NGINX Instance Manager 2.24.0, F5 WAF for NGINX 5.16.0, 5.14.2, F5 DoS for NGINX 4.11.0, NGINX Gateway Fabric 2.8.0, And NGINX Ingress Controller 5.7.0.
• Patch versions addressing CVE-2026-95101 are NGINX Plus 37.0.7.1, 37.2.0.1, NGINX Open Source 1.30.6, 1.31.7, NGINX Instance Manager 2.24.0, F5 WAF for NGINX 5.14.2, 5.16.0, F5 DoS for NGINX 4.11.0, NGINX Gateway Fabric 2.8.0, And NGINX Ingress Controller 5.7.0.
• Patch versions addressing CVE-2026-97629 are NGINX Plus 37.0.5.1, 37.1.0.1, NGINX Open Source 1.30.6, 1.31.7, NGINX Instance Manager 2.24.0, F5 WAF for NGINX 5.14.2, 5.16.0, F5 DoS for NGINX 4.11.0, NGINX Gateway Fabric 2.8.0, And NGINX Ingress Controller 5.7.0.