cyber.hendryadrian.com
Vulnerability & Exploit · securityweek.com

F5 Patches Eight NGINX and BIG-IP Vulnerabilities

· Original article ↗

Summary

F5 issued an out-of-band security rollout fixing eight NGINX and BIG-IP vulnerabilities. The most severe, CVE-2026-42533 (CVSS 9.2), can cause a heap buffer overflow; F5 did not report in-the-wild exploitation.

Key points

  • CVE-2026-42533 affects NGINX Plus and NGINX Open Source and can be triggered by crafted HTTP requests under specific configuration conditions.
  • The critical flaw can restart the NGINX worker process; code execution is possible on systems with ASLR disabled.
  • Other NGINX flaws can expose memory contents, restart worker processes, or cause a use-after-free that enables memory modification or process restart.
  • Two NGINX Ingress Controller vulnerabilities could let authenticated attackers inject configuration directives or modify resources to cause file deletion, service disruption, or denial of service.
  • A BIG-IP flaw could let remote, unauthenticated attackers increase memory use and cause denial of service when an HTTP/2 profile is configured on a virtual server.
  • F5 did not mention any of the vulnerabilities being exploited in the wild.

Article Details

Vulnerability Types
  • Heap buffer overflow
  • Memory disclosure
  • Use-after-free
  • NGINX configuration directive injection
  • Denial of service
Severity
Critical (CVSS 9.2 for CVE-2026-42533); other addressed vulnerabilities are described as high severity.
Exploitation Status
not_reported
Exploit Availability
unknown
Patch Status
available

MITRE ATT&CK

T1499 · Endpoint Denial of ServiceThe described BIG-IP and NGINX vulnerabilities could be exploited to cause denial of service, including by increasing memory use or restarting worker processes.

CVE

CVE-2026-42533F5 · NGINX Open Source; F5 · NGINX PlusThe most severe flaw is CVE-2026-42533 (CVSS score of 9.2), a critical issue in NGINX Plus and NGINX Open Source that could be exploited via crafted HTTP requests to cause a heap buffer overflow and restart the NGINX

Vendors

F5F5 on Wednesday announced an out-of-band security rollout that patches eight vulnerabilities in NGINX and BIG-IP.

Products

BIG-IPF5 on Wednesday announced an out-of-band security rollout that patches eight vulnerabilities in NGINX and BIG-IP.NGINX Ingress ControllerTwo high-severity vulnerabilities addressed in NGINX Ingress Controller could allow authenticated attackers to inject arbitrary NGINX configuration directives to delete files and disable services, or create or modifyNGINX Open SourceThe most severe flaw is CVE-2026-42533 (CVSS score of 9.2), a critical issue in NGINX Plus and NGINX Open Source that could be exploited via crafted HTTP requests to cause a heap buffer overflow and restart the NGINXNGINX PlusThe most severe flaw is CVE-2026-42533 (CVSS score of 9.2), a critical issue in NGINX Plus and NGINX Open Source that could be exploited via crafted HTTP requests to cause a heap buffer overflow and restart the NGINX

Related Articles