nginx and Brotli findings in the 1.0.0–1.3.1 console images
Image scanners report four high-severity CVEs in the console image of 1.0.0 through 1.3.1: three in nginx 1.30.5, its web server, each needing an nginx configuration BROKA does not have, and one in the Brotli library, which nothing in the running console uses. 1.3.2 runs nginx 1.30.6 and Brotli 1.2.1, which fix all four.
Not exploitable in any configuration BROKA ships
- Affected
- 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.1.2, 1.2.0, 1.2.1, 1.3.0, 1.3.1
- Fixed in
- 1.3.2
- Editions
- Community and Commercial
- Severity
- High
- CVEs
- CVE-2026-15176, CVE-2026-93479, CVE-2026-97205, CVE-2026-111497
What was found
Image scanners report four high-severity vulnerabilities in the console image — the image that serves BROKA's web console — of every version from 1.0.0 to 1.3.1: three in nginx 1.30.5, its web server, and one in the Brotli library:
| Component | Image | CVE | Upstream severity | In BROKA |
|---|---|---|---|---|
| nginx 1.30.5 | Console | CVE-2026-15176 | High | not reachable |
| nginx 1.30.5 | Console | CVE-2026-93479 | High | not reachable |
| nginx 1.30.5 | Console | CVE-2026-97205 | High | not reachable |
| Brotli 1.2.0 | Console | CVE-2026-111497 | High | never run |
Both editions are affected the same way: Community 1.0.0 through 1.3.1, and Commercial 1.0.1 through 1.3.1. The broker service and Orchestrator images carry neither.
Why none of them reaches BROKA
Each of the three nginx findings is triggered only by a particular nginx configuration, and the console image's configuration is BROKA's own, the same in every release. The Brotli finding is in a library the console never calls.
Aliases and $request_filename — CVE-2026-15176
A heap buffer overflow, reachable with an unauthenticated request, needs a location that combines alias with a
rewrite, set or return that references $request_filename, or $request_filename in an access log format.
BROKA's configuration has no alias and never references $request_filename.
Regex captures in map — CVE-2026-93479
A heap buffer overflow needs a map whose regular expression captures a variable that a root directive or an access
log format references before the map's own variable is used. BROKA has one such capture: the map that decides which
scheme a trusted proxy reported uses it only as its own value. Its root is a fixed path, and neither of its log
formats names the capture.
Asynchronous I/O with SSI — CVE-2026-97205
A use-after-free needs asynchronous file I/O (aio) enabled together with Server Side Includes serving an
include virtual. BROKA's configuration enables neither.
The Brotli decoder — CVE-2026-111497
An out-of-bounds write in the Brotli decoder can be triggered by crafted compressed data. In the console image the
library is there only for curl and for the font libraries behind nginx's optional image-filter module. nginx itself
does not use Brotli, BROKA's configuration loads no optional module, and nothing in the image runs curl — the health
check uses the image's own wget.
What to do
Upgrade to 1.3.2. Its console image runs nginx 1.30.6 and Brotli 1.2.1, which fix all four; an upgrade is new images and a restart, and the 1.3.2 release notes have the details. No earlier version needs a workaround in the meantime — unless you replace the console's nginx configuration with your own, in which case check it against the three nginx conditions above.
Scanners that read OpenVEX can take this advisory's statements from the document linked on this page, which names each affected image by digest.
Timeline
- 2026-10-14: F5 publishes CVE-2026-15176, CVE-2026-93479 and CVE-2026-97205.
- 2026-10-19: an nginx 1.30.6 base image is published.
- 2026-10-23: the nightly scan of 1.3.1's published images reports the three nginx findings; the console image moves to nginx 1.30.6 for 1.3.2.
- 2026-10-24: the release's image scan reports the Brotli finding, and the console image takes Brotli 1.2.1; 1.3.2 is released with this advisory.