F5 issued out-of-band patches for multiple NGINX vulnerabilities, including two critical ones: CVE-2026-42530 in the ngx_http_v3_module and CVE-2026-42055 in the ngx_http_proxy_v2_module and ngx_http_grpc_module. These vulnerabilities can be exploited by unauthenticated remote attackers to trigger denial-of-service via use-after-free or heap-based buffer overflow conditions or execute code on systems with ASLR disabled or bypassed. The affected products include NGINX Plus, NGINX Open Source, NGINX Gateway Fabric, and NGINX Instance Manager. F5 also patched two high-severity vulnerabilities (CVE-2026-11311 and CVE-2026-50107) in NGINX Gateway Fabric that allow authenticated attackers to inject arbitrary configuration directives. Mitigations for CVE-2026-42530 include disabling HTTP/3 by removing 'quic' from listen directives; for CVE-2026-42055, removing 'ignore_invalid_headers off' and reducing 'large_client_header_buffers' below 2MB. F5 has not reported any active exploitation of these vulnerabilities.

Successful exploitation of CVE-2026-42530 and CVE-2026-42055 can cause denial-of-service by crashing NGINX worker processes or enable remote code execution on systems with ASLR disabled or bypassed. The high-severity vulnerabilities in NGINX Gateway Fabric allow authenticated attackers to inject arbitrary configuration directives, potentially leading to unauthorized configuration changes. These vulnerabilities affect critical web server infrastructure and could disrupt services or compromise system integrity if exploited.

F5 has released official security patches addressing these vulnerabilities for all affected NGINX products. Administrators should apply these out-of-band updates promptly. For those unable to immediately patch, mitigations include disabling HTTP/3 by removing 'quic' from all listen directives to mitigate CVE-2026-42530, and removing the 'ignore_invalid_headers off' directive and reducing 'large_client_header_buffers' below 2 megabytes to mitigate CVE-2026-42055. No additional mitigations are indicated for the high-severity configuration injection flaws beyond applying the patches. There are no reports of active exploitation, but timely patching is strongly recommended.