Loading story…
F5 has disclosed multiple vulnerabilities affecting NGINX product lines, including NGINX Open Source, NGINX Plus, NGINX Gateway Fabric, and NGINX Ingress Controller, with the most serious issue tracked as CVE-2026-42533. The flaw can lead to remote code execution, while additional reported weaknesses include information disclosure and security restriction bypass across several version ranges. National cybersecurity authorities in Europe have highlighted the breadth of affected products and the severity of the exposure.
F5 released fixes on 2026-07-15 and urged customers to update immediately, warning that the vulnerable configuration is considered typical even if not every deployment is affected. Authorities also noted that proof-of-concept exploit code is already public, raising the likelihood of opportunistic attacks despite no confirmed large-scale exploitation so far. Where immediate patching is not possible, temporary mitigations are available, but vendor-recommended upgrades to fixed versions remain the primary remediation step.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
F5 released security updates for multiple NGINX and F5 NGINX-related products, including fixes for the critical remote code execution flaw CVE-2026-42533. The vendor advised customers to update immediately and noted mitigations were available if patching could not be done at once.
Proof-of-concept exploit code for CVE-2026-42533 was published, increasing the risk of exploitation. The notice said no large-scale exploitation had yet been observed at the time of reporting.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
cert.ug
Open sourcekyberturvallisuuskeskus.fi
Open sourceboho.or.kr
Open sourceacn.gov.it
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
F5 released patches for two critical remote code execution vulnerabilities in **NGINX Open Source** and **NGINX Plus**: `CVE-2026-42530`, a use-after-free flaw in the HTTP/3 QUIC module, and `CVE-2026-42055`, a heap-based buffer overflow in HTTP/2 proxy modules. Both issues carry a **CVSS 9.2** rating and can be exploited remotely without authentication under specific configurations, potentially affecting a broad set of F5 NGINX products including **NGINX Plus, Ingress Controller, Gateway Fabric, Instance Manager, and App Protect WAF**. F5 said the flaws were fixed in **NGINX Open Source 1.31.2 and 1.30.3** and published mitigations for organizations that cannot patch immediately, including disabling HTTP/3, restoring `ignore_invalid_headers` to its default behavior, and reducing `large_client_header_buffers` sizes. A related Apache HTTP Server security update was also issued by EG-FinCIRT, underscoring continued patching activity around widely deployed web server infrastructure, although no active exploitation of the NGINX flaws had been confirmed at the time of reporting.
Jul 7, 2026
F5 disclosed multiple high-severity vulnerabilities affecting **NGINX Open Source**, **NGINX Plus**, and related products, including a critical heap-based buffer overflow in `ngx_http_proxy_v2_module` and `ngx_http_grpc_module` tracked as **CVE-2026-42055**. The flaw can be triggered remotely without authentication when HTTP/2 proxying or `grpc_pass` is enabled, `ignore_invalid_headers` is set to `off`, and `large_client_header_buffers` exceeds 2 MB, allowing oversized headers to crash worker processes and potentially enable code execution if ASLR is bypassed. F5 also disclosed **CVE-2026-42530**, a critical use-after-free in the open-source `ngx_http_v3_module` that can be exploited through a crafted HTTP/3 QUIC session to reopen a QPACK encoder stream, again causing worker restarts and possible code execution. A separate issue, **CVE-2026-11311**, affects **NGINX Gateway Fabric** when **NGINX Plus** is used as the data plane, allowing authenticated users with permission to modify relevant CRDs to inject arbitrary NGINX directives through unsanitized values in `NginxProxy.serverTokens` and `AuthenticationFilter.extraAuthArgs`. F5's out-of-band advisory said the exposure spans a broad set of products, including **NGINX Ingress Controller**, **NGINX Instance Manager**, **NGINX App Protect WAF**, **NGINX App Protect DoS**, **F5 WAF for NGINX Instance Manager**, and **F5 DoS for NGINX**. Updated releases, including **nginx 1.31.2** and the stable branch **1.30.3**, were published to address the core NGINX flaws, and defenders were urged to patch affected versions or disable HTTP/3 QUIC where immediate updates are not possible.
Jul 23, 2026
F5 disclosed multiple NGINX vulnerabilities across modules, with the most serious issues centered on the `ngx_http_rewrite_module`, including **CVE-2026-42945** and **CVE-2026-9256**. The flaw dubbed **NGINX Rift** is a long-standing heap buffer overflow in the rewrite engine that can be triggered remotely through crafted HTTP requests, leading to worker crashes, repeated restarts, and denial of service; under some conditions, including disabled ASLR, remote code execution is possible. CSIRT.SK reported active exploitation of **CVE-2026-42945** and said the bug affects both NGINX Open Source and F5/NGINX-related products, while F5 also published advisories for additional bugs in `ngx_http_proxy_v2_module`, `ngx_http_charset_module`, and `ngx_http_js_module`. Independent analysis of the two rewrite-engine RCE bugs found that exploitation depends on specific rewrite patterns involving `rewrite`, `if`, `set`, positional captures, and question-mark handling in PCRE-based rules. Researchers behind the **ngxray** scanner reviewed 35,633 public NGINX configurations from GitHub and found only one confirmed real-world vulnerable configuration after triage, suggesting the bugs are severe but uncommon in exposed public configs. Defenders were urged to upgrade to fixed releases, including **NGINX Open Source 1.30.1 or 1.31.0** and **NGINX Plus R32 P6 or R36 P4**, and to review or mitigate risky rewrite directives where patches were not yet available.
Jul 30, 2026