# 2.24.1 release notes

> Release notes for F5 NGINX Instance Manager, including new features, improvements, and bug fixes in each release.

---


November 05, 2026

NGINX Instance Manager 2.24.1 release notes

## Upgrade Paths {#2-24-1-upgrade-paths}

NGINX Instance Manager 2.24.1 supports upgrades from these previous versions:

- 2.21.0 - 2.24.0

If your NGINX Instance Manager version is older, you may need to upgrade to an intermediate version before upgrading to the target version.

## Security updates{#2-24-1-security-updates}

**important:** 
For the protection of our customers, NGINX doesn’t disclose security issues until an investigation has occurred and a fix is available.

This release includes the following security updates:

- [icon: resolved] **Security updates: Go 1.26.10, NGINX 1.31.8, and NGINX Agent 2.47.2**<a name="2-24-1-security-updates-Security-updates-Go-12610-NGINX-1318-and-NGINX-Agent-2472-48809"></a>

   This release includes the following security updates:

   - NGINX Instance Manager services are now built with Go 1.26.10, which rejects certificates issued from the compromised eMudhra intermediate certificate authorities ([CVE-2026-111943](https://www.cve.org/CVERecord?id=CVE-2026-111943)). In earlier versions, an attacker who could intercept NGINX Instance Manager's outbound HTTPS traffic and held a certificate from one of these intermediates could impersonate an endpoint that NGINX Instance Manager connects to. Inbound connections to NGINX Instance Manager and communication between NGINX Instance Manager and NGINX Agent were not affected.

   - The nim-standalone-compose, rootless, and API gateway images now use NGINX 1.31.8 and updated base OS packages, resolving the following CVEs:
     - apache2-utils: [CVE-2026-59797](https://www.cve.org/CVERecord?id=CVE-2026-59797), [CVE-2026-57941](https://www.cve.org/CVERecord?id=CVE-2026-57941), [CVE-2026-56154](https://www.cve.org/CVERecord?id=CVE-2026-56154), [CVE-2026-93546](https://www.cve.org/CVERecord?id=CVE-2026-93546), [CVE-2026-73636](https://www.cve.org/CVERecord?id=CVE-2026-73636), [CVE-2026-73637](https://www.cve.org/CVERecord?id=CVE-2026-73637), [CVE-2026-63718](https://www.cve.org/CVERecord?id=CVE-2026-63718), [CVE-2026-63686](https://www.cve.org/CVERecord?id=CVE-2026-63686), [CVE-2026-63292](https://www.cve.org/CVERecord?id=CVE-2026-63292), [CVE-2026-63045](https://www.cve.org/CVERecord?id=CVE-2026-63045), [CVE-2026-56449](https://www.cve.org/CVERecord?id=CVE-2026-56449), [CVE-2026-56153](https://www.cve.org/CVERecord?id=CVE-2026-56153), [CVE-2026-48005](https://www.cve.org/CVERecord?id=CVE-2026-48005), [CVE-2026-47360](https://www.cve.org/CVERecord?id=CVE-2026-47360), [CVE-2026-46729](https://www.cve.org/CVERecord?id=CVE-2026-46729)
     - curl: [CVE-2026-8927](https://www.cve.org/CVERecord?id=CVE-2026-8927), [CVE-2026-8924](https://www.cve.org/CVERecord?id=CVE-2026-8924), [CVE-2026-8286](https://www.cve.org/CVERecord?id=CVE-2026-8286), [CVE-2026-92392](https://www.cve.org/CVERecord?id=CVE-2026-92392), [CVE-2026-8926](https://www.cve.org/CVERecord?id=CVE-2026-8926), [CVE-2026-9079](https://www.cve.org/CVERecord?id=CVE-2026-9079), [CVE-2026-10536](https://www.cve.org/CVERecord?id=CVE-2026-10536), [CVE-2026-11856](https://www.cve.org/CVERecord?id=CVE-2026-11856), [CVE-2026-18924](https://www.cve.org/CVERecord?id=CVE-2026-18924), [CVE-2026-19931](https://www.cve.org/CVERecord?id=CVE-2026-19931)
     - expat: [CVE-2026-66046](https://www.cve.org/CVERecord?id=CVE-2026-66046), [CVE-2026-76956](https://www.cve.org/CVERecord?id=CVE-2026-76956), [CVE-2026-76957](https://www.cve.org/CVERecord?id=CVE-2026-76957), [CVE-2026-93990](https://www.cve.org/CVERecord?id=CVE-2026-93990), [CVE-2026-77214](https://www.cve.org/CVERecord?id=CVE-2026-77214), [CVE-2026-102633](https://www.cve.org/CVERecord?id=CVE-2026-102633)
     - Brotli: [CVE-2026-111497](https://www.cve.org/CVERecord?id=CVE-2026-111497)
     - Other OS libraries: [CVE-2026-78030](https://www.cve.org/CVERecord?id=CVE-2026-78030), [CVE-2026-86219](https://www.cve.org/CVERecord?id=CVE-2026-86219), [CVE-2026-52490](https://www.cve.org/CVERecord?id=CVE-2026-52490), [CVE-2026-6653](https://www.cve.org/CVERecord?id=CVE-2026-6653), [CVE-2026-19445](https://www.cve.org/CVERecord?id=CVE-2026-19445)

   - The bundled NGINX Agent is updated from 2.47.1 to 2.47.2, resolving [CVE-2026-111943](https://www.cve.org/CVERecord?id=CVE-2026-111943), [CVE-2026-97045](https://www.cve.org/CVERecord?id=CVE-2026-97045) and [CVE-2026-78661](https://www.cve.org/CVERecord?id=CVE-2026-78661).

   For versions earlier than 2.24.1:
   - Restrict access to the NGINX Instance Manager interface (port 443) to trusted administrative networks, and do not publish the internal NGINX Instance Manager service ports.
   - For [CVE-2026-111943](https://www.cve.org/CVERecord?id=CVE-2026-111943): in the nim-standalone-compose and integrations containers, disable the emSign and AAA Certificate Services entries in /etc/ca-certificates.conf (prefix with "!"), run update-ca-certificates and restart NGINX Instance Manager. Restrict NGINX Instance Manager's outbound access to the required F5 endpoints.

## Known issues {#2-24-1-known-issues}

You can find information about known issues in the [Known Issues](/nim/releases/known-issues.md) topic.