Apparently F5 shipped it in production in their proprietary version, while it was not compiled into the free version. So technically the CVE should be filed ag

Apparently F5 shipped it in production in their proprietary version, while it was not compiled into the free version. So technically the CVE should be filed against NGINX Plus, not nginx ;)