F5 has released emergency security updates to address two critical vulnerabilities in NGINX Open Source , which are rated 9.2 on the CVSS v4 system. The two vulnerabilities could, under certain conditions, allow remote and unauthorized attackers to execute malicious code on affected systems.
The two new vulnerabilities that worry system administrators
The first vulnerability, CVE-2026-42530, concerns a use-after-free error in the ngx_http_v3_module. The issue can be triggered when NGINX is configured to use the HTTP/3 QUIC module. An attacker can create specially crafted HTTP/3 sessions, causing a QPACK encoder stream and, in some cases, achieve code execution, especially on systems where ASLR is disabled or can be bypassed.
The second vulnerability, CVE-2026-42055 , is located in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules . It is a heap-based buffer overflow that can be triggered by a remote attacker when the proxy_http_version to 2 or grpc_pass directives are used to proxy HTTP/2 traffic, the ignore_invalid_headers directive is disabled , and the large_client_header_buffers directive size is greater than 2 MB, and code is executed on systems with Address Space Layout Randomization disabled (or when the attacker can bypass ASLR).
Which versions are affected?
F5 confirmed that the two vulnerabilities affect a large number of products in the NGINX ecosystem, including NGINX Open Source, NGINX Plus, NGINX Gateway Fabric, NGINX Instance Manager, NGINX Ingress Controller, as well as the F5 WAF and NGINX App Protect security solutions.
For CVE-2026-42530, the issue has been fixed in NGINX Open Source 1.31.2 and NGINX Gateway Fabric 2.6.4, while several versions of the company's traffic management and control products are also affected.
See also: Microsoft confirms RoguePlanet Defender zero-day – Preparing patch
Specifically:
- NGINX Open Source 1.31.0 – 1.31.1 (Fixed in 1.31.2)
- NGINX Gateway Fabric 2.0.0 – 2.6.3 (Fixed in 2.6.4)
- NGINX Gateway Fabric 1.3.0 – 1.6.2
- NGINX Instance Manager 2.17.0 – 2.22.0
- NGINX Ingress Controller 5.0.0 – 5.5.0
- NGINX Ingress Controller 4.0.0 – 4.0.1
- NGINX Ingress Controller 3.5.0 – 3.7.2
Accordingly, CVE-2026-42055 is addressed in NGINX Plus 37.0.2.1 , NGINX Plus R36 P6 , as well as NGINX Open Source updates 1.31.2 and 1.30.3 . The list of affected products is extensive and includes application protection platforms , DoS attack mitigation solutions and Kubernetes environment management tools:
- NGINX Plus 37.0.0 – 37.0.1 (Fixed in 37.0.2.1)
- NGINX Plus R33 – R36 (Fixed in R36 P6)
- NGINX Open Source 1.31.1 (Fixed in 1.31.2)
- NGINX Open Source 1.30.0 – 1.30.2 (Fixed in 1.30.3)
- NGINX Instance Manager 2.17.0 – 2.22.0
- F5 WAF for NGINX 5.9.0 – 5.13.1
- NGINX App Protect WAF 5.2.0 – 5.8.0
- NGINX App Protect WAF 4.10.0 – 4.16.0
- F5 DoS for NGINX 4.9.0
- NGINX App Protect DoS 4.3.0 – 4.7.0
- NGINX Gateway Fabric 2.0.0 – 2.6.3 (Fixed in 2.6.4)
- NGINX Gateway Fabric 1.3.0 – 1.6.2
- NGINX Ingress Controller 5.0.0 – 5.5.0
- NGINX Ingress Controller 4.0.0 – 4.0.1
- NGINX Ingress Controller 3.5.0 – 3.7.2
See also: SAP fixes critical remote code execution flaws
Temporary solutions until the updates are installed
The company recommends specific mitigation measures for organizations that cannot immediately apply the available patches.
In the case of the CVE-2026-42530 vulnerability , the recommendation is to temporarily disable HTTP/3 , thus limiting the attack surface that exploits the QUIC protocol.
For CVE-2026-42055, F5 recommends removing the ignore_invalid_headers off from the NGINX configuration or reducing the large_client_header_buffers to less than 2 MB.
Why the issue is of particular importance
Although F5 has not yet identified widespread exploitation of the two new vulnerabilities, cybersecurity experts are treating the situation with increased caution. NGINX is one of the most popular web servers and reverse proxies in the world, supporting millions of websites, cloud applications, and enterprise infrastructures.
The platform's widespread adoption means that any critical security flaw can become a significant business risk. Cybercriminals closely monitor the release of new vulnerabilities, often developing exploits within days of their announcement.
Concerns are further heightened by the recent incident with CVE-2026-42945, also known as NGINX Rift. This critical vulnerability in NGINX Plus and NGINX Open Source was actively exploited shortly after its public disclosure, demonstrating how short the response time for organizations now is.
See also: OpenAI: Up to $100,000 for critical infrastructure flaws
The need for immediate mobilization
F5’s new disclosures underscore once again that security patch management is not just a maintenance process, but a critical factor in operational resilience. Organizations using NGINX technologies are urged to promptly assess their exposure, apply available fixes, and review the security parameters of their infrastructure, as delaying the installation of updates can turn a theoretical security hole into a real entry point for large-scale attacks.
