NHS England issued an alert on October 19, 2026 urging organisations to address three NGINX vulnerabilities that could allow unauthenticated attackers to disrupt services or potentially execute code. The warning covers NGINX Plus and Open Source deployments with specific configurations, and rates each flaw at 9.2 under CVSS v4. [NHS England advisory](https://digital.nhs.uk/cyber-alerts/2026/cc-4872).

France's CERT-FR also published an advisory on October 19 covering affected F5 products, including NGINX Ingress Controller, Gateway Fabric and Instance Manager. Its notice references vendor bulletins dated October 14: the new alerts concern existing fixes, rather than patches first released on October 19. [CERT-FR advisory](https://cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1341/).

The vulnerability descriptions reproduced by NHS England identify CVE-2026-15176 as a heap buffer overflow involving alias, rewrite and references to $request_filename. CVE-2026-93479 involves regex captures in map directives or certain non-cacheable variable expressions. Crafted HTTP requests can trigger worker-process failures under the required conditions.

NHS England identifies CVE-2026-97205 as a use-after-free involving asynchronous file I/O and Server Side Includes processing. Memory corruption or crashes are possible. The advisory says code execution requires Address Space Layout Randomisation to be disabled or bypassed, and describes the flaws as data-plane issues without control-plane exposure.

NGINX's official security index lists Open Source versions 1.30.6 and 1.31.7, and later releases in those branches, as not vulnerable to all three flaws. It classifies them as medium severity under its own scheme. Affected version ranges differ, so exposure depends on both the installed release and configuration. [NGINX security index](https://nginx.org/en/security_advisories.html).

CERT-FR directs administrators to the vendor bulletins for product-specific fixes; a single Open Source version number does not describe remediation for every bundled product. NHS England recommends applying the relevant updates promptly and reviewing regex-based map directives to ensure named captures are used. Its configuration guidance gives defenders a concrete review task alongside deployment of the applicable patches.