NGINX labels all five October 2026 fixes medium. F5, the company behind NGINX, scores three of them 9.2 Critical on CVSS v4.0. The gap is not a mistake in either document; it reflects two different measurement philosophies, and understanding the difference is what tells an operator how fast to move.

The five in one place

CVE-2026-15176 is a heap overflow reached through an alias location that rewrites and reads $request_filename; affected releases run from 0.1.29 to 1.31.6. CVE-2026-93479 is a heap overflow where a regex map has its captures referenced by root or log_format; affected branches are 1.30.0 to 1.30.5 and 1.31.2 to 1.31.6. CVE-2026-97205 is a use-after-free requiring aio with SSI include virtual pages. CVE-2026-95101 is the HTTP/3 parser bug that can inject bytes past client_max_body_size. CVE-2026-97629 is the TLS session-ticket forgery.

The three memory bugs carry the 9.2. The TLS flaw carries 8.3. The HTTP/3 flaw carries 6.9.

Why the vendor scores disagree

NGINX's advisories page rates each issue medium. That rating is a vendor convention tied to configuration preconditions: none of the five fires on a default build of the affected versions, so none is a single-request compromise across the whole installed base.

CVSS v4.0, as F5 applies it, weighs the consequences once the preconditions are met. A heap overflow in a worker that can plausibly become remote code execution is a high-impact outcome, and CVSS v4.0 explicitly models attacker control and exploitation context rather than assuming a default configuration.

Both statements are true at once. For a fleet, the NGINX rating describes average risk. For a specific server that does use alias with rewrite, the F5 rating describes that server's risk far more accurately.

Which configuration decides

Four of the five depend on a directive that is off by default or needs operator action: alias in a rewriting location, aio plus SSI, ssl_session_cache shared without ssl_session_ticket_key, and a regex map feeding root or log_format. The exception is HTTP/3, where one half of the condition, proxy_request_buffering, ships on.

That distribution matters for triage. A server using only root and no SSI, no shared session cache and no QUIC listener is not exposed to any of the five, regardless of version. A server that terminates TLS for client-certificate-protected endpoints and uses the shared cache is exposed to the 8.3 flaw even without any of the memory bugs.

Remediation path

Upgrade to 1.30.6 or 1.31.7. The stable release, per NGINX, contains only fixes.

If the upgrade cannot happen this week, the workarounds are narrow and precise: stop combining alias with rewrite, use named captures inside the regex block, turn aio off or stop serving SSI, set proxy_request_buffering off, and either drop the shared session cache or load explicit ticket keys. Distros that have backported the patches are fixed; distros that have not are not, and a package version that looks new does not prove a backport.

Operational reading

Treat the CVSS gap as a routing instruction. Systems that match one of the configuration preconditions are 9.2-class emergencies. Systems that match none are routine patch-window work. The way to know is one command, nginx -T, and five searches through its output.

Sources

  • NGINX security advisories: https://nginx.org/en/security_advisories.html

  • F5 advisory K000162416: https://my.f5.com/manage/s/article/K000162416

  • F5 advisory K000162606: https://my.f5.com/manage/s/article/K000162606

  • F5 advisory K000162607: https://my.f5.com/manage/s/article/K000162607

  • F5 advisory K000162608: https://my.f5.com/manage/s/article/K000162608

  • F5 advisory K000162613: https://my.f5.com/manage/s/article/K000162613

  • NGINX download page: https://nginx.org/en/download.html