F5 Patched Critical NGINX Remote Code Execution Flaws
Patch & Detection Intelligence · 2 sources · Updated 4mo ago · First seen Jul 7, 2026
F5 released patches for two critical remote code execution vulnerabilities in NGINX Open Source and NGINX Plus: CVE-2026-42530, a use-after-free flaw in the HTTP/3 QUIC module, and CVE-2026-42055, a heap-based buffer overflow in HTTP/2 proxy modules. Both issues carry a CVSS 9.2 rating and can be exploited remotely without authentication under specific configurations, potentially affecting a broad set of F5 NGINX products including NGINX Plus, Ingress Controller, Gateway Fabric, Instance Manager, and App Protect WAF.
F5 said the flaws were fixed in NGINX Open Source 1.31.2 and 1.30.3 and published mitigations for organizations that cannot patch immediately, including disabling HTTP/3, restoring ignore_invalid_headers to its default behavior, and reducing large_client_header_buffers sizes. A related Apache HTTP Server security update was also issued by EG-FinCIRT, underscoring continued patching activity around widely deployed web server infrastructure, although no active exploitation of the NGINX flaws had been confirmed at the time of reporting.
