Loading story…
F5 released patches for two critical remote code execution vulnerabilities in NGINX Open Source and NGINX Plus: CVE-2026-42530, a use-after-free flaw in the HTTP/3 QUIC module, and CVE-2026-42055, a heap-based buffer overflow in HTTP/2 proxy modules. Both issues carry a CVSS 9.2 rating and can be exploited remotely without authentication under specific configurations, potentially affecting a broad set of F5 NGINX products including NGINX Plus, Ingress Controller, Gateway Fabric, Instance Manager, and App Protect WAF.
F5 said the flaws were fixed in NGINX Open Source 1.31.2 and 1.30.3 and published mitigations for organizations that cannot patch immediately, including disabling HTTP/3, restoring ignore_invalid_headers to its default behavior, and reducing large_client_header_buffers sizes. A related Apache HTTP Server security update was also issued by EG-FinCIRT, underscoring continued patching activity around widely deployed web server infrastructure, although no active exploitation of the NGINX flaws had been confirmed at the time of reporting.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
F5 released patches for two critical NGINX vulnerabilities, CVE-2026-42530 and CVE-2026-42055, affecting NGINX Open Source, NGINX Plus, and related products. Fixes were provided in NGINX Open Source 1.31.2 and 1.30.3, along with mitigations such as disabling HTTP/3 and adjusting header handling settings.
EG-FinCIRT published an Apache HTTP Server security update notice dated 09 June 2026. The reference provides no further synopsis or event details beyond the publication of the update.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
F5 disclosed multiple high-severity vulnerabilities affecting **NGINX Open Source**, **NGINX Plus**, and related products, including a critical heap-based buffer overflow in `ngx_http_proxy_v2_module` and `ngx_http_grpc_module` tracked as **CVE-2026-42055**. The flaw can be triggered remotely without authentication when HTTP/2 proxying or `grpc_pass` is enabled, `ignore_invalid_headers` is set to `off`, and `large_client_header_buffers` exceeds 2 MB, allowing oversized headers to crash worker processes and potentially enable code execution if ASLR is bypassed. F5 also disclosed **CVE-2026-42530**, a critical use-after-free in the open-source `ngx_http_v3_module` that can be exploited through a crafted HTTP/3 QUIC session to reopen a QPACK encoder stream, again causing worker restarts and possible code execution. A separate issue, **CVE-2026-11311**, affects **NGINX Gateway Fabric** when **NGINX Plus** is used as the data plane, allowing authenticated users with permission to modify relevant CRDs to inject arbitrary NGINX directives through unsanitized values in `NginxProxy.serverTokens` and `AuthenticationFilter.extraAuthArgs`. F5's out-of-band advisory said the exposure spans a broad set of products, including **NGINX Ingress Controller**, **NGINX Instance Manager**, **NGINX App Protect WAF**, **NGINX App Protect DoS**, **F5 WAF for NGINX Instance Manager**, and **F5 DoS for NGINX**. Updated releases, including **nginx 1.31.2** and the stable branch **1.30.3**, were published to address the core NGINX flaws, and defenders were urged to patch affected versions or disable HTTP/3 QUIC where immediate updates are not possible.
Jul 23, 2026
F5 disclosed and patched multiple NGINX vulnerabilities, including the high-severity `CVE-2026-32647` in `ngx_http_mp4_module`, which affects both **NGINX Open Source** and **NGINX Plus**. The flaw is an out-of-bounds read memory corruption issue triggered when NGINX processes a specially crafted MP4 file, allowing a local authenticated attacker to crash worker processes in the data plane and potentially achieve arbitrary code execution. F5 said the control plane is not affected and credited Xint Code and Pavel Kohout of Aisle Research with the discovery and coordinated disclosure. The vulnerable condition impacts deployments using the `mp4` directive with `ngx_http_mp4_module` enabled; the module is included by default in NGINX Plus, while NGINX Open Source requires it to be explicitly compiled and enabled. F5 also published advisories for `CVE-2026-27654` in `ngx_http_dav_module` and `CVE-2026-28755` in `ngx_stream_ssl_module`, indicating a broader set of NGINX fixes released together. The company issued patched versions for affected NGINX Plus and Open Source releases and advised organizations that cannot patch immediately to disable the MP4 module and limit media publishing to trusted users.
Jun 29, 2026
F5 disclosed multiple NGINX vulnerabilities across modules, with the most serious issues centered on the `ngx_http_rewrite_module`, including **CVE-2026-42945** and **CVE-2026-9256**. The flaw dubbed **NGINX Rift** is a long-standing heap buffer overflow in the rewrite engine that can be triggered remotely through crafted HTTP requests, leading to worker crashes, repeated restarts, and denial of service; under some conditions, including disabled ASLR, remote code execution is possible. CSIRT.SK reported active exploitation of **CVE-2026-42945** and said the bug affects both NGINX Open Source and F5/NGINX-related products, while F5 also published advisories for additional bugs in `ngx_http_proxy_v2_module`, `ngx_http_charset_module`, and `ngx_http_js_module`. Independent analysis of the two rewrite-engine RCE bugs found that exploitation depends on specific rewrite patterns involving `rewrite`, `if`, `set`, positional captures, and question-mark handling in PCRE-based rules. Researchers behind the **ngxray** scanner reviewed 35,633 public NGINX configurations from GitHub and found only one confirmed real-world vulnerable configuration after triage, suggesting the bugs are severe but uncommon in exposed public configs. Defenders were urged to upgrade to fixed releases, including **NGINX Open Source 1.30.1 or 1.31.0** and **NGINX Plus R32 P6 or R36 P4**, and to review or mitigate risky rewrite directives where patches were not yet available.
Jul 24, 2026