Customer Security Advisory: Critical F5/NGINX Out-of-Band Vulnerabilities

What to do

• Check whether your product depends on Akamai Cloud (Linode). Check your stack

  Paste a package.json, lockfile, Terraform or a list of domains at down.guide/stack to see every provider you depend on.

• Confirm your retries, queues and scheduled jobs caught up after the 0m it lasted.

  Anything that failed between 2026-10-22 20:08 UTC and 2026-10-22 20:08 UTC may need a replay.

• Subscribe to Akamai Cloud (Linode)'s feed to hear about the next one first. RSS feed

  https://down.guide/feed?provider=linode works in Slack (/feed subscribe), Discord feed bots and any RSS reader.

Updates from Akamai Cloud (Linode) 1

1. investigatingOct 22, 2026, 8:08 PM UTC

   Akamai is aware of the recently published F5/NGINX vulnerabilities (CVE-2026-15176, CVE-2026-97205, and CVE-2026-93479), and our teams are actively investigating their potential impact across our platform and infrastructure. F5 has released out-of-band security patches addressing three critical severity vulnerabilities in NGINX Open Source and NGINX Plus. These vulnerabilities may allow unauthenticated attackers to trigger heap buffer overflows, which could cause a denial of service or potential remote code execution if ASLR is bypassed. If you are running a vulnerable version of NGINX Open Source or NGINX Plus on a Linode instance, we recommend following guidance from F5/NGINX and applying available patches. We will provide updates as additional information becomes available.

   provider

Corrections

None so far.

Something wrong on this page? Report an error or send us a note. Every fix is listed here.