nginx-ingress and CVE-2025-1974 (aka IngressNightmare)

Yesterday a set of 5 critical vulnerability was announced in ingress-nginx which allows remote code exec and reading secrets for unauthenticated users. The discoverers have named this #IngressNightmare.

As I understand it, F5's nginx-ingress uses the same codebase.

Can F5 confirm whether nginx-ingress is or is not vulnerable to these vulnerabilities?

Thanks!  MisterPaul

References:

• https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilities
• https://kubernetes.io/blog/2025/03/24/ingress-nginx-cve-2025-1974/