F5 issues emergency NGINX patches for three critical flaws
F5 has released out-of-band fixes for several NGINX vulnerabilities, including three critical bugs that could allow unauthenticated remote attackers to cause denial-of-service or execute code under certain configurations. The flaws affect components such as the HTTP/3 module and the map directive, and patches cover NGINX Plus, Open Source, Ingress Controller, Gateway Fabric, and Instance Manager. F5 has not reported active exploitation, but the company's products have been targeted by attackers in the past.
F5's emergency update covers three critical NGINX bugs. Two sit in the HTTP/3 module, while the third involves the map directive. Under non-default setups, unauthenticated remote users could trigger memory corruption in worker processes, causing crashes, restarts, or potentially code execution if ASLR protections are absent or bypassed.
Affected products include NGINX Plus, Open Source, Ingress Controller, Gateway Fabric, and Instance Manager. Temporary mitigations involve avoiding certain alias or request-filename uses, turning off asynchronous file I/O or server-side includes, and preferring named regex captures within the matching block. F5 has not reported exploitation.
The flaws may affect organizations relying on NGINX for websites, APIs, and cloud infrastructure, including businesses, public services, and their users. If exploited, outages or compromised servers could disrupt access, expose data, or increase remediation costs. Because F5 products have drawn advanced attackers before, administrators may face pressure to patch quickly, though no active exploitation has been reported. The broader risk could extend beyond direct customers to downstream users of affected online services.