VulnerabilityPublished 18 Jun 2026

F5 issues out-of-band patches for critical NGINX vulnerabilities

Source Bleeping Computer

Mentioned vulnerabilities

Severity

Critical

Rated by Threat Radar

Data as of 18 Jun 2026, 22:00 UTC

What to do

AI-suggested

F5 has released official security patches addressing these vulnerabilities for all affected NGINX products. Administrators should apply these out-of-band updates promptly. For those unable to immediately patch, mitigations include disabling HTTP/3 by removing 'quic' from all listen directives to mitigate CVE-2026-42530, and removing the 'ignore_invalid_headers off' directive and reducing 'large_client_header_buffers' below 2 megabytes to mitigate CVE-2026-42055. No additional mitigations are indicated for the high-severity configuration injection flaws beyond applying the patches. There are no reports of active exploitation, but timely patching is strongly recommended.

Description

Cybersecurity company F5 has released out-of-band security updates to address multiple NGINX web server vulnerabilities, including two critical-severity flaws that could allow attackers to execute code on vulnerable systems. [...]

Impact

Successful exploitation of CVE-2026-42530 and CVE-2026-42055 can cause denial-of-service by crashing NGINX worker processes or enable remote code execution on systems with ASLR disabled or bypassed. The high-severity vulnerabilities in NGINX Gateway Fabric allow authenticated attackers to inject arbitrary configuration directives, potentially leading to unauthorized configuration changes. These vulnerabilities affect critical web server infrastructure and could disrupt services or compromise system integrity if exploited.

Summary

F5 issued out-of-band patches for multiple NGINX vulnerabilities, including two critical ones: CVE-2026-42530 in the ngx_http_v3_module and CVE-2026-42055 in the ngx_http_proxy_v2_module and ngx_http_grpc_module. These vulnerabilities can be exploited by unauthenticated remote attackers to trigger denial-of-service via use-after-free or heap-based buffer overflow conditions or execute code on systems with ASLR disabled or bypassed. The affected products include NGINX Plus, NGINX Open Source, NGINX Gateway Fabric, and NGINX Instance Manager. F5 also patched two high-severity vulnerabilities (CVE-2026-11311 and CVE-2026-50107) in NGINX Gateway Fabric that allow authenticated attackers to inject arbitrary configuration directives. Mitigations for CVE-2026-42530 include disabling HTTP/3 by removing 'quic' from listen directives; for CVE-2026-42055, removing 'ignore_invalid_headers off' and reducing 'large_client_header_buffers' below 2MB. F5 has not reported any active exploitation of these vulnerabilities.

References

bleepingcomputer.com/news/security/f5-issues-out-of-band-patches-for-critical-nginx-vulnerabilities/ (opens in a new tab)

Community reviews

Loading reviews…

What to do

Description

AI analysisMachine-generated, updated 18 Jun 2026, 11:35 UTC

References

Community reviews

Related threats