F5 disclosed and patched multiple critical and high-severity vulnerabilities in NGINX products. The most severe are CVE-2026-42530 and CVE-2026-42055, which affect HTTP modules and can be exploited remotely without authentication to trigger use-after-free or heap-based buffer overflow conditions. Exploitation causes the NGINX worker process to restart, resulting in denial-of-service, and may lead to arbitrary code execution if ASLR is disabled or bypassed. Additional vulnerabilities CVE-2026-11311 and CVE-2026-50107 in NGINX Gateway Fabric allow authenticated attackers to inject arbitrary configuration directives, potentially exposing sensitive data, proxying traffic to attacker-controlled endpoints, or causing denial-of-service by preventing configuration reloads. Medium-severity flaws allow remote attackers to disclose memory contents or cause worker process restarts or denial-of-service. F5 has released out-of-band security updates addressing these issues across NGINX Plus, Open Source, and Gateway Fabric. No known exploitation in the wild has been reported. Users are urged to apply the updates promptly.

Successful exploitation of CVE-2026-42530 and CVE-2026-42055 can cause denial-of-service by restarting the NGINX worker process and potentially allow remote, unauthenticated attackers to execute arbitrary code if ASLR is bypassed. Exploitation of CVE-2026-11311 and CVE-2026-50107 by authenticated attackers can lead to arbitrary injection of NGINX configuration directives, exposing sensitive data, redirecting traffic to attacker-controlled endpoints, or causing denial-of-service by preventing configuration reloads. Medium-severity vulnerabilities may disclose memory contents or cause denial-of-service conditions. These vulnerabilities affect the availability, confidentiality, and integrity of NGINX deployments.

F5 has released official security updates for NGINX Plus, NGINX Open Source, and NGINX Gateway Fabric that address all disclosed vulnerabilities. Users should apply these out-of-band patches immediately to remediate the critical and high-severity flaws. No mention of any vulnerabilities being already mitigated or requiring no action was made by the vendor. Patch status is confirmed by the vendor advisory. There is no indication that these vulnerabilities are present in cloud-hosted services managed by the vendor. Users should follow F5's security notification for detailed patching instructions.