F5 addressed eight vulnerabilities in NGINX and BIG-IP products via an out-of-band security update. The critical vulnerability (CVE-2026-42533) affects NGINX Plus and Open Source when using a map directive with regex matching and string expressions referencing regex capture variables before map output variables, leading to a heap buffer overflow and worker process restart. On systems without ASLR, this can lead to code execution. Additional high-severity bugs include memory leaks, use-after-free issues in NGINX modules (ngx_http_slice_module, ngx_http_ssi_module), and configuration injection vulnerabilities in NGINX Ingress Controller that allow authenticated attackers to modify configurations or cause denial-of-service. BIG-IP has a high-severity flaw causing increased memory usage and DoS when HTTP/2 profiles are configured. None of these vulnerabilities are known to be exploited in the wild. F5 has released patches for all these issues.

Successful exploitation can lead to unauthorized modification of configurations, denial-of-service through process termination or restart, memory leaks, use-after-free conditions, and in some cases, remote code execution on vulnerable NGINX systems without ASLR. The vulnerabilities affect both unauthenticated and authenticated attackers depending on the flaw. The BIG-IP vulnerability can cause denial-of-service by exhausting memory resources. No active exploitation has been reported.

F5 has released official patches addressing all identified vulnerabilities in NGINX Plus, NGINX Open Source, NGINX Ingress Controller, and BIG-IP products. Applying these patches promptly is the recommended mitigation. No mention of alternative mitigations or temporary workarounds is provided. Organizations should follow F5's out-of-band security notification and update affected systems accordingly.