cyber.hendryadrian.com
Vulnerability & Exploit · thehackernews.com

F5 Patches Two Critical NGINX Flaws That Could Enable Remote Code Execution

· Original article ↗

Summary

F5 patched two critical NGINX vulnerabilities that could allow remote unauthenticated code execution under specific configurations. No confirmed in-the-wild exploitation was reported; F5 also provided temporary mitigations.

Key points

  • CVE-2026-42530 is a use-after-free in NGINX's HTTP/3 module, potentially exploitable through a crafted session when HTTP/3 QUIC is enabled.
  • CVE-2026-42055 is a heap-based buffer overflow affecting specified HTTP/2 proxy configurations and header settings.
  • Both flaws could allow remote unauthenticated code execution under the stated conditions, including when ASLR is disabled or bypassed.
  • F5 listed affected versions across NGINX Open Source and several related products, with fixes available in specified updated releases.
  • Temporary mitigations include disabling HTTP/3 for CVE-2026-42530 and changing header-related settings for CVE-2026-42055.
  • F5 reported no confirmed exploitation of these vulnerabilities in the wild.

Article Details

Vulnerability Types
  • Use-after-free
  • Heap-based buffer overflow
Severity
Critical; CVSS v4 score 9.2 for both vulnerabilities
Affected Versions
  • NGINX Open Source 1.31.0–1.31.1 (CVE-2026-42530)
  • NGINX Gateway Fabric 2.0.0–2.6.3 (CVE-2026-42530)
  • NGINX Gateway Fabric 1.3.0–1.6.2 (CVE-2026-42530)
  • NGINX Instance Manager 2.17.0–2.22.0 (CVE-2026-42530)
  • NGINX Ingress Controller 5.0.0–5.5.0 (CVE-2026-42530)
  • NGINX Ingress Controller 4.0.0–4.0.1 (CVE-2026-42530)
  • NGINX Ingress Controller 3.5.0–3.7.2 (CVE-2026-42530)
  • NGINX Plus 37.0.0–37.0.1 (CVE-2026-42055)
  • NGINX Plus R33–R36 (CVE-2026-42055)
  • NGINX Open Source 1.31.1 (CVE-2026-42055)
  • NGINX Open Source 1.30.0–1.30.2 (CVE-2026-42055)
  • F5 WAF for NGINX 5.9.0–5.13.1 (CVE-2026-42055)
  • NGINX App Protect WAF 5.2.0–5.8.0 (CVE-2026-42055)
  • NGINX App Protect WAF 4.10.0–4.16.0 (CVE-2026-42055)
  • F5 DoS for NGINX 4.9.0 (CVE-2026-42055)
  • NGINX App Protect DoS 4.3.0–4.7.0 (CVE-2026-42055)
Exploitation Status
not_reported
Exploit Availability
unknown
Patch Status
available
Workarounds
  • For CVE-2026-42530, disable HTTP/3.
  • For CVE-2026-42055, remove the ignore_invalid_headers off directive from the configuration, or reduce the large_client_header_buffers directive size below 2 MB.

CVE

CVE-2026-42055F5 · Dos; F5 · Nginx gateway fabric; +9 moreF5 has released patches for two critical NGINX Open Source vulnerabilities, CVE-2026-42530 and CVE-2026-42055, that could allow remote unauthenticated attackers to execute code under certain configurations.CVE-2026-42530F5 · Nginx gateway fabric; F5 · Nginx ingress controller; +2 moreF5 has released patches for two critical NGINX Open Source vulnerabilities, CVE-2026-42530 and CVE-2026-42055, that could allow remote unauthenticated attackers to execute code under certain configurations.CVE-2026-42945F5 · NGINX Open Source; F5 · NGINX Plus; +21 moreAs recently as last month, another critical security defect in NGINX Plus and NGINX Open Source (CVE-2026-42945, CVSS score: 9.2), also called NGINX Rift, came under active exploitation within days after public

Vendors

F5F5 has released patches for two critical NGINX Open Source vulnerabilities, CVE-2026-42530 and CVE-2026-42055, that could allow remote unauthenticated attackers to execute code under certain configurations.

Products

F5 DoS for NGINXF5 DoS for NGINX 4.9.0F5 WAF for NGINXF5 WAF for NGINX 5.9.0 – 5.13.1NGINX App Protect DoSNGINX App Protect DoS 4.3.0 – 4.7.0NGINX App Protect WAFNGINX App Protect WAF 5.2.0 – 5.8.0NGINX Gateway FabricNGINX Gateway Fabric 2.0.0 – 2.6.3 (Fixed in 2.6.4)NGINX Ingress ControllerNGINX Ingress Controller 5.0.0 – 5.5.0NGINX Instance ManagerNGINX Instance Manager 2.17.0 – 2.22.0NGINX Open SourceF5 has released patches for two critical NGINX Open Source vulnerabilities, CVE-2026-42530 and CVE-2026-42055, that could allow remote unauthenticated attackers to execute code under certain configurations.NGINX PlusNGINX Plus 37.0.0 – 37.0.1 (Fixed in 37.0.2.1)

Related Articles