F5, Juniper Networks Patch Critical Vulnerabilities

What it is

F5's NGINX security release fixes 11 flaws, and Juniper published 17 advisories covering over 150 flaws in Junos OS, Junos OS Evolved and Cloud-Native Router (JCNR). The page gives no fixed-version numbers for either vendor. Take those from the vendor advisories.

How it works

Critical NGINX bugs

• CVE-2026-15176 and CVE-2026-93479: An unauthenticated attacker sends crafted HTTP requests. This triggers a buffer overflow, but "under certain conditions beyond their control". The default outcome is a restart. RCE needs ASLR to be disabled or bypassed.
• CVE-2026-97205: Memory corruption or worker process termination. RCE is possible only if ASLR is disabled.

Other NGINX bugs The eight non-critical NGINX flaws are not itemized by CVE. The page lists these classes:

• verification/validation bypass
• sensitive information disclosure
• request attribute spoofing
• data injection in proxied requests
• unbounded memory growth
• access to protected paths before authentication

Juniper About two dozen criticals cover root code/command execution, full device takeover, kernel panic, crashes, Routing Engine reboot and service disruption. One is an off-by-one buffer overflow. Multiple high-severity flaws (RCE, DoS) are also patched.

Preconditions / Affected

• For NGINX, the realistic baseline exposure is a remotely triggerable crash or restart. Check whether ASLR is disabled on your hosts, since that turns the critical bugs into RCE.
• The auth-related NGINX fixes matter if NGINX enforces access control or proxies requests for you.
• For Juniper, the affected products are Junos OS, Junos OS Evolved and JCNR.

What to do

• Apply the F5 NGINX and Juniper updates. The page names no workarounds.
• Confirm ASLR is enabled on NGINX hosts. This is an inference from the stated RCE condition, not advice the page gives.

Caveats

• Neither vendor mentions exploitation in the wild.
• The page gives no CVE ids for the Juniper flaws and no CVSS scores.