Back Securityaffairs.Co

F5 Patches Critical NGINX Vulnerabilities Enabling Unauthenticated Code Execution

Securityaffairs.Co •Pierluigi Paganini • June 18, 2026

F5 released emergency updates for critical NGINX flaws (CVE-2026-42530, CVE-2026-42055) that could enable unauthenticated code execution. F5 has issued out-of-band patches for multiple NGINX vulnerabilities, including two critical flaws, respectively tracked as CVE-2026-42530 and CVE-2026-42055 (CVSS 9.2). The bugs affect HTTP modules and can be exploited remotely without authentication to trigger memory corruption, potentially causing […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

F5 Issues Critical Patches for NGINX Vulnerabilities Allowing Remote Code Execution On June 17, 2026, F5 released emergency patches for two critical vulnerabilities in NGINX, CVE-2026-42530 and CVE-2026-42055. These vulnerabilities affect NGINX Open Source, NGINX Plus, and related products, allowing unauthenticated remote attackers to execute arbitrary code and cause denial-of-service (DoS) attacks. CVE-2026-42530 is a use-after-free vulnerability in the HTTP/3 module, while CVE-2026-42055 is a heap buffer overflow in the HTTP/2 and gRPC modules. Both vulnerabilities have a CVSS v4.0 score of 9.2, indicating their critical severity. F5 advises immediate patching, as exploitation could occur rapidly. The vulnerabilities impact a significant portion of the web, with NGINX running on approximately 38% of active websites worldwide. Patches are available for affected versions, and interim mitigations are suggested for those unable to update immediately. 24 sources 80

Extracted Entities

F5 Patches Critical NGINX Vulnerabilities Enabling Unauthenticated Code Execution

The full story

Extracted Entities

Attack Types (1)

CVEs (2)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Tools (1)