NGINX Memory Flaws Are a DFARS 7012 Readiness Drill

Readiness is proven before an incident, not during one. A public web server patch is a good place to prove it.

On October 14, 2026, F5 published out-of-band security notification K000163408. It fixes three NGINX memory flaws. F5 scores each flaw 9.2 under Common Vulnerability Scoring System (CVSS) version 4.0. NGINX itself rates them medium. File both scores. A reviewer will notice the gap and ask about it.

The three flaws

Common Vulnerabilities and Exposures (CVE) is the public record system. All three flaws are unauthenticated and network reachable. None needs user interaction. All three carry high attack complexity.

• CVE-2026-15176: heap buffer overflow in the core HTTP module, triggered by alias and rewrite directives using $request_filename.
• CVE-2026-97205: use-after-free flaw, needing asynchronous file input/output (AIO) with Server Side Includes (SSI) virtual includes.
• CVE-2026-93479: heap buffer overflow from premature regex map capture references and certain non-cacheable variable expressions.

The main impact is a worker process crash or restart. Code execution needs Address Space Layout Randomization (ASLR) disabled or bypassed. That limit matters for impact scoring. It does not change the patch order.

Fixed builds are NGINX Open Source 1.30.6 and 1.31.7, and NGINX Plus 37.1.0.1 and 37.0.5.1.

What readiness looks like here

Safeguarding means knowing what you run and proving you fixed it. Start with the NGINX inventory, version per server. Check each config for the three triggers. Upgrade affected builds. Keep the dated re-scan.

That record does double duty. It proves the patch landed. It also proves your team can find, fix, and document a flaw fast. That speed is what incident readiness really measures.

No confirmed exploitation was reported through October 20, 2026. The Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog does not list them. A quiet week is the best time to run the drill.

Sources

• F5 security notification K000163408, NGINX Open Source and NGINX Plus vulnerabilities, October 14, 2026.
• CVE-2026-15176 record, CVE Program.
• CVE-2026-97205 record, CVE Program.
• CVE-2026-93479 record, CVE Program.
• Original diagram by PolicyCortex.

Next step

Want safeguarding evidence linked without chasing spreadsheets? See how PolicyCortex collects it from live systems.