F5 has rolled out out-of-band security updates for multiple vulnerabilities in NGINX, including two critical flaws. These allow attackers to execute code on vulnerable systems with non-standard configurations.
The vulnerabilities are located in the modules ngx_http_v3_module (CVE-2026-42530) and ngx_http_proxy_v2_module/ngx_http_grpc_module (CVE-2026-42055). These are two critical flaws that could have serious consequences. Unauthenticated attackers can exploit them for a denial-of-service attack or code execution on systems where Address Space Layout Randomization (ASLR) is disabled.
F5 has released patches for NGINX Plus, NGINX Open Source, NGINX Gateway Fabric, and NGINX Instance Manager. Administrators who cannot install the updates immediately can mitigate CVE-2026-42530 by disabling HTTP/3, and CVE-2026-42055 by removing the ignore_invalid_headers off-directive and reducing the large_client_header_buffers size to below 2 MB.
Two high-risk flaws in NGINX Gateway Fabric
Additionally, there are two high-risk vulnerabilities in NGINX Gateway Fabric (CVE-2026-11311 and CVE-2026-50107). These can be used by authenticated attackers to inject arbitrary NGINX configuration rules.
F5 reports that none of these flaws are currently being actively exploited. In the past, vulnerabilities in F5 products have been exploited for intrusions, the placement of data-wiping malware, mapping internal servers, and theft of sensitive documents.
Historical context and risks
In October 2025, F5 revealed that state-sponsored actors had compromised its systems in August 2025, stealing unknown BIG-IP vulnerabilities and source code. In recent years, the US CISA has designated seven F5 vulnerabilities as actively exploited, four of which were used in ransomware attacks.