Loading story…
NGINX released versions 1.31.3 and 1.30.4 to fix three security vulnerabilities affecting both NGINX Open Source and F5 NGINX Plus. The most severe issue, CVE-2026-42533, affects configurations using the map directive with regex matching in unsafe expression patterns and can be triggered by a crafted HTTP request from an unauthenticated attacker. F5 said the flaw can cause a heap buffer overflow in the worker process, leading to denial of service through worker restarts and, in environments where protections such as ASLR are disabled or bypassed, possible remote code execution. The issue is limited to the data plane, with no reported control plane exposure.
The updates also address CVE-2026-60005 in ngx_http_slice_module, where unauthenticated requests or background cache updates can trigger uninitialized memory access when the slice directive and unnamed regex captures are used, causing limited memory disclosure or worker crashes. A third flaw, CVE-2026-56434, affects ngx_http_ssi_module when SSI, proxy_pass, and proxy_buffering off are combined, allowing an attacker with man-in-the-middle control over upstream responses to trigger a heap buffer over-read that may restart the worker process or enable limited memory modification. The release additionally includes hardening and functional changes, including XML external entity controls for ngx_http_xslt_filter_module, new socket buffer directives, and HTTP/2 buffer handling improvements.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
A report provided new technical details on CVE-2026-42533, describing how improper save/restore of PCRE capture state in nginx’s internal script engine can create both a heap buffer overflow and information leak that can be chained to unauthenticated RCE. The report also said the bug has reportedly been exploitable since March 2011, identified a named-capture variant, and noted release of a static configuration scanner while full exploit details were withheld for 21 days after the patch.
CVE-2026-56434 was disclosed as a heap buffer over-read in ngx_http_ssi_module affecting F5 NGINX Plus and NGINX Open Source. An unauthenticated attacker with man-in-the-middle control over upstream responses can trigger the flaw when SSI, proxy_pass, and proxy_buffering off are configured, potentially causing limited memory modification or worker restart.
CVE-2026-60005 was disclosed as an uninitialized memory access flaw in ngx_http_slice_module affecting F5 NGINX Plus and NGINX Open Source. Unauthenticated requests can trigger memory disclosure or worker process restart when the slice directive and unnamed regex captures are configured, or during a background cache update.
A vulnerability tracked as CVE-2026-42533 was disclosed affecting F5 NGINX Plus and NGINX Open Source when the map directive uses regex matching in unsafe expression patterns. Crafted HTTP requests can trigger a heap buffer overflow in the worker process, causing denial of service and potentially code execution under certain conditions.
NGINX released version 1.31.3 and the stable branch update 1.30.4 to fix three security issues: CVE-2026-42533, CVE-2026-60005, and CVE-2026-56434. The updates also included several non-security changes such as XSLT XXE controls and HTTP/2 buffer handling improvements.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
24 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityaffairs.com
Open sourcethecyberexpress.com
Open sourcethecybersecguru.com
Open sourcegithub.com
Open sourcecyberstan.co.uk
Open sourcenginx.org
Open sourcenginx.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
NGINX released versions **1.31.1** and **1.30.2** to fix **CVE-2026-9256**, a heap buffer overflow in `ngx_http_rewrite_module` that can be triggered by unauthenticated attackers with specially crafted HTTP requests. The flaw affects **NGINX Open Source** and **NGINX Plus** when `rewrite` directives use overlapping or nested PCRE capture groups and replacement strings that reference multiple captures in redirect or arguments contexts, creating memory corruption in the worker process. Successful exploitation can force worker restarts and denial of service, and may lead to arbitrary code execution if protections such as ASLR are absent or bypassed; NGINX described the issue as a **data plane** exposure with no control plane impact.
Jun 29, 2026
F5 disclosed multiple high-severity vulnerabilities affecting **NGINX Open Source**, **NGINX Plus**, and related products, including a critical heap-based buffer overflow in `ngx_http_proxy_v2_module` and `ngx_http_grpc_module` tracked as **CVE-2026-42055**. The flaw can be triggered remotely without authentication when HTTP/2 proxying or `grpc_pass` is enabled, `ignore_invalid_headers` is set to `off`, and `large_client_header_buffers` exceeds 2 MB, allowing oversized headers to crash worker processes and potentially enable code execution if ASLR is bypassed. F5 also disclosed **CVE-2026-42530**, a critical use-after-free in the open-source `ngx_http_v3_module` that can be exploited through a crafted HTTP/3 QUIC session to reopen a QPACK encoder stream, again causing worker restarts and possible code execution. A separate issue, **CVE-2026-11311**, affects **NGINX Gateway Fabric** when **NGINX Plus** is used as the data plane, allowing authenticated users with permission to modify relevant CRDs to inject arbitrary NGINX directives through unsanitized values in `NginxProxy.serverTokens` and `AuthenticationFilter.extraAuthArgs`. F5's out-of-band advisory said the exposure spans a broad set of products, including **NGINX Ingress Controller**, **NGINX Instance Manager**, **NGINX App Protect WAF**, **NGINX App Protect DoS**, **F5 WAF for NGINX Instance Manager**, and **F5 DoS for NGINX**. Updated releases, including **nginx 1.31.2** and the stable branch **1.30.3**, were published to address the core NGINX flaws, and defenders were urged to patch affected versions or disable HTTP/3 QUIC where immediate updates are not possible.
Jul 23, 2026
F5 and NGINX disclosed **CVE-2026-42945** ("**NGINX Rift**"), a critical heap buffer overflow in `ngx_http_rewrite_module` affecting **NGINX Open Source 0.6.27 through 1.30.0** and **NGINX Plus R32 through R36**. The bug is exposed when servers use a specific rewrite pattern: a `rewrite` directive with unnamed PCRE captures such as `$1` or `$2`, a replacement string containing `?`, and a following `rewrite`, `if`, or `set` directive. An unauthenticated attacker can send crafted HTTP requests to corrupt heap memory in the worker process, reliably causing crashes and restarts; code execution is considered possible in weaker environments, particularly where **ASLR is disabled**. Fixes were released in **NGINX 1.30.1**, **1.31.0**, and patched NGINX Plus builds, while Debian, AlmaLinux, and other downstream vendors began shipping updates. Public writeups and proof-of-concept code quickly drove attacker interest, and multiple reports said **VulnCheck observed exploitation attempts on canary systems** within days of disclosure. Researchers and defenders broadly agreed that denial-of-service is the most practical near-term impact, while widespread reliable RCE is less likely on hardened systems with modern memory protections enabled. Administrators were urged to patch internet-facing reverse proxies, load balancers, ingress controllers, and API gateways, audit rewrite rules for unnamed captures, and use named captures as a temporary mitigation where upgrades cannot be applied immediately. The same release cycle also addressed additional NGINX flaws including **CVE-2026-42946**, **CVE-2026-40701**, and **CVE-2026-42934**.
Jun 29, 2026