Attackers can exploit high-severity vulnerabilities in NGINX to cause worker process crashes and, under certain conditions, achieve remote code execution. Patch immediately.
F5 has released an out-of-band security advisory to address a use-after-free vulnerability in the ngx_http_v3_module (CVE-2026-42530) and a heap-based buffer overflow vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module (CVE-2026-42055) affecting NGINX.
The vulnerabilities have Common Vulnerability Scoring System (CVSS v3.1) scores of: CVE-2026-42530 at 8.1 and CVE-2026-42055 at 8.1 out of 10.
Successful exploitation of these vulnerabilities could lead to the following:
CVE-2026-42530: Due to a use-after-free vulnerability in the ngx_http_v3_module, an unauthenticated attacker could send a crafted HTTP/3 session to crash the NGINX worker process, with potential remote code execution if ASLR is disabled or bypassed.
CVE-2026-42055: Due to a heap-based buffer overflow vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module, an unauthenticated attacker could send oversized headers to crash the NGINX worker process, with potential remote code execution if ASLR is disabled or bypassed.
NGINX Open Source 1.x: versions 1.31.0 through 1.31.1
NGINX Instance Manager 2.x: versions 2.17.0 through 2.22.0
NGINX Gateway Fabric 2.x: versions 2.0.0 through 2.6.3
NGINX Gateway Fabric 1.x: versions 1.3.0 through 1.6.2
NGINX Ingress Controller 5.x: versions 5.0.0 through 5.5.0
NGINX Ingress Controller 4.x: versions 4.0.0 through 4.0.1
NGINX Ingress Controller 3.x: versions 3.5.0 through 3.7.2
NGINX Plus 37.x: versions 37.0.0 through 37.0.1
NGINX Plus Rx: versions R33 through R36
NGINX Open Source 1.x: versions 1.31.1, and 1.30.0 through 1.30.2
NGINX Instance Manager 2.x: versions 2.17.0 through 2.22.0
F5 WAF for NGINX 5.x: versions 5.9.0 through 5.13.1
NGINX App Protect WAF 5.x: versions 5.2.0 through 5.8.0
NGINX App Protect WAF 4.x: versions 4.10.0 through 4.16.0
F5 DoS for NGINX 4.x: version 4.9.0
NGINX App Protect DoS 4.x: versions 4.3.0 through 4.7.0
NGINX Gateway Fabric 2.x: versions 2.0.0 through 2.6.3
NGINX Gateway Fabric 1.x: versions 1.3.0 through 1.6.2
NGINX Ingress Controller 5.x: versions 5.0.0 through 5.5.0
NGINX Ingress Controller 4.x: versions 4.0.0 through 4.0.1
NGINX Ingress Controller 3.x: versions 3.5.0 through 3.7.2
Users and administrators of affected products are advised to update to the latest versions immediately.
As an interim measure, users and administrators who are unable to update immediately can apply the following mitigations:
Disable HTTP/3 (remove quic from all listen directives).
Remove the ignore_invalid_headers off directive from the configuration.
Reduce the large_client_header_buffers directive size below 2 megabytes.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
