F5 Issues Out-of-Band Patches for Critical NGINX Vulnerabilities
Summary
F5 issued out-of-band fixes for critical NGINX flaws that may enable denial of service or, under certain conditions, code execution. It also patched two high-severity NGINX Gateway Fabric flaws and provided mitigations.
Key points
- CVE-2026-42530 affects ngx_http_v3_module; CVE-2026-42055 affects ngx_http_proxy_v2_module and ngx_http_grpc_module.
- The critical flaws can be triggered remotely without authentication on systems using non-default configurations, potentially causing denial of service.
- Code execution may be possible if ASLR is disabled or bypassed.
- F5 released fixes for affected NGINX Plus, NGINX Open Source, NGINX Gateway Fabric, and NGINX Instance Manager products.
- For CVE-2026-42530, F5 recommends disabling HTTP/3; for CVE-2026-42055, it recommends changing header-related configuration settings.
- CVE-2026-11311 and CVE-2026-50107 affect NGINX Gateway Fabric and can allow authenticated attackers to inject NGINX configuration directives.
- F5 did not identify any of these vulnerabilities as exploited in attacks.
Article Details
- Vulnerability Types
- Use-after-free
- Heap-based buffer overflow
- NGINX configuration directive injection
- Severity
- Critical for CVE-2026-42530 and CVE-2026-42055; high for CVE-2026-11311 and CVE-2026-50107
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- For CVE-2026-42530, disable HTTP/3 by removing quic from all listen directives.
- For CVE-2026-42055, remove the ignore_invalid_headers off directive and reduce the large_client_header_buffers directive size below 2 megabytes.
MITRE ATT&CK
CVE
Vendors
Products
NGINXF5 has issued out-of-band updates for multiple NGINX vulnerabilities, including critical flaws in ngx_http_v3_module and ngx_http_proxy_v2_module/ngx_http_grpc_module that could lead to denial of service or remote codeNGINX Gateway FabricThe company also patched high-severity issues in NGINX Gateway Fabric and provided mitigations for admins who cannot immediately apply the updates.NGINX Instance ManagerF5 has released security fixes for multiple NGINX software products affected by these two vulnerabilities, including NGINX Plus and NGINX Open Source, NGINX Gateway Fabric, and NGINX Instance Manager.NGINX Open SourceF5 has released security fixes for multiple NGINX software products affected by these two vulnerabilities, including NGINX Plus and NGINX Open Source, NGINX Gateway Fabric, and NGINX Instance Manager.NGINX PlusF5 has released security fixes for multiple NGINX software products affected by these two vulnerabilities, including NGINX Plus and NGINX Open Source, NGINX Gateway Fabric, and NGINX Instance Manager.