Two labels for the same three bugs

Open the nginx.org advisory page and the three October 2026 entries read "Severity: medium". Open the CVE records for CVE-2026-93479, CVE-2026-97205 and CVE-2026-15176 and each carries a CVSS v3.1 base score of 8.1 and a CVSS v4.0 score of 9.2. Both come from the same vendor. Neither is wrong, and the difference explains a lot about how these disclosures should be handled.

What the project label captures

The nginx.org page describes defects in terms of the trigger and the fix. CVE-2026-93479 is a buffer overflow in script evaluation. CVE-2026-97205 is a use-after-free when using asynchronous file I/O. CVE-2026-15176 is a buffer overflow when using alias with rewrite. Each entry lists a vulnerable range and a fixed version, and each was fixed in 1.31.7 and 1.30.6.
Medium, in that framing, means the default configuration does not expose the defect. An operator who never enables AIO, never processes SSI include virtual and never combines alias with rewrite has a server that will not enter the broken code. The label describes reachability under normal settings.

What the CVSS score captures

CVSS does not model a specific deployment. It models the worst plausible case for the base metrics: network attack vector, no privileges required, no user interaction, high confidentiality and integrity impact, high availability impact, high attack complexity. The high complexity figure is where the conditional nature of these bugs shows up, and it is what keeps a 9.2 from being a 10.
Read the CVSS v4.0 vector for what it is worth. It says an unauthenticated network attacker with a prepared request can reach a code execution outcome under conditions the attacker does not fully control. That is a fair description of a memory-corruption primitive that needs a specific configuration.

Why both numbers belong in a risk decision

A security team that triages only on CVSS will schedule all three fixes at the top of the queue, which is defensible and expensive if the estate is large. A team that triages only on the project label may postpone work on hosts that do carry the risky configuration, because "medium" reads as low priority in a ticket system.
Hold both. Use the project label to ask whether the trigger exists. Use the CVSS score to set the response speed on the hosts where it does. The nginx.org page tells an operator which version to move to. The CVE record tells them what an unpatched host can suffer.

Checking the trigger

For CVE-2026-93479, look for map directives that use regex matching and whose captures are consumed by root or by a log format, plus any non-cacheable variable used inside a string expression. For CVE-2026-97205, look for aio enabled alongside SSI processing of pages with include virtual. For CVE-2026-15176, look for a location block that uses alias with rewrite and references $request_filename, or any log format that references $request_filename.
If none of those patterns exist, the version range is still worth closing but the urgency is lower. If one exists, the CVSS score is the better estimate of what is at stake.

Affected scope in one place

Open Source ranges are 1.31.2 to 1.31.6 and 1.30.0 to 1.30.5 for CVE-2026-93479, 0.8.11 to 1.31.6 for CVE-2026-97205, and 0.1.29 to 1.31.6 for CVE-2026-15176. Fixed releases are 1.31.7 and 1.30.6.
NGINX Plus 37.0.0 to 37.0.4 and R33 through R36 are affected and fixed at 37.1.0.1 or 37.0.5.1. Ecosystem products in the affected set include NGINX Instance Manager 2.18.0 to 2.23.0, F5 WAF for NGINX 5.9.0 to 5.15.0, NGINX App Protect WAF 4.12.0 to 4.16.0 and 5.4.0 to 5.8.0, F5 DoS for NGINX 4.8.0 to 4.10.0, NGINX App Protect DoS 4.5.0 to 4.7.0, NGINX Gateway Fabric 2.1.0 to 2.7.2 and NGINX Ingress Controller 5.6.0 to 5.6.3. BIG-IP, BIG-IQ, F5OS and F5 Distributed Cloud Services are unaffected.

Exposure numbers, read carefully

ZoomEye returned 49,500,935 matches for http.header.server="nginx" && port="443" on 26 October 2026, and zero for vul.cve="CVE-2026-93479". The first figure describes publicly visible nginx surface, not vulnerable hosts. The zero describes index coverage for the CVE tag, not an untouched population. Neither label nor score changes what those queries can see.

References

  • nginx.org security advisories: https://nginx.org/en/security_advisories.html

  • CVE-2026-93479 record: https://www.cve.org/CVERecord?id=CVE-2026-93479

  • CVE-2026-97205 record: https://www.cve.org/CVERecord?id=CVE-2026-97205

  • CVE-2026-15176 record: https://www.cve.org/CVERecord?id=CVE-2026-15176

  • F5 advisory K000162607: https://my.f5.com/manage/s/article/K000162607

  • F5 advisory K000162608: https://my.f5.com/manage/s/article/K000162608

  • F5 advisory K000162416: https://my.f5.com/manage/s/article/K000162416