NGINX Vulnerability Patch: F5 Fixes Critical HTTP/3 and HTTP/2 Remote Code Execution Flaws

F5 issued an emergency out-of-band security advisory on June 17, 2026, covering two critical vulnerabilities in NGINX — the web server and reverse proxy software running on approximately 38% of all active websites globally — that allow unauthenticated remote attackers to crash worker processes and potentially execute arbitrary code on the host system. Patches are available and must be applied now: the last time F5 disclosed a critical NGINX flaw of this severity class, active exploitation began just three days after disclosure.

The advisory, designated K000161614 and updated June 18, covers vulnerabilities across NGINX Open Source, NGINX Plus, NGINX Gateway Fabric, NGINX Ingress Controller, and several NGINX-related security modules. Two of the disclosed flaws carry the maximum CVSS v4.0 score the advisory uses — 9.2 — and both can be triggered without authentication.

The first vulnerability, CVE-2026-42530 , is a use-after-free in NGINX's HTTP/3 QUIC module (ngx_http_v3_module). When NGINX is configured to handle HTTP/3 traffic — as it increasingly is in modern cloud-native deployments — an attacker can send a specially crafted QUIC session that reopens a QPACK encoder stream after it has been freed. This causes the worker process to reference deallocated memory, triggering a restart. On systems where Address Space Layout Randomization (ASLR) is disabled or can be bypassed, the memory corruption escalates to arbitrary code execution.

The second, CVE-2026-42055 , is a heap buffer overflow in NGINX's HTTP/2 proxy and gRPC modules (ngx_http_proxy_v2_module and ngx_http_grpc_module). The flaw is triggered only when three non-default conditions are simultaneously present: HTTP/2 backend proxying or a grpc_pass directive is enabled; the ignore_invalid_headers directive is set to off; and the large_client_header_buffers directive is configured to more than 2 MB. When those conditions exist, a remote attacker can send oversized headers that overflow a heap buffer during upstream request handling.

Both CVEs affect NGINX Open Source versions through 1.31.1 and NGINX Plus. The vulnerable version range for CVE-2026-42055 is particularly broad — dating back to version 1.13.10, meaning any deployment that has not been actively maintained and patched in recent years is almost certainly affected.

Both CVEs are documented as allowing code execution on systems where ASLR "is disabled or when the attacker can bypass ASLR." That second clause matters more than it might appear.

Address Space Layout Randomization is an operating system mitigation that randomizes the memory addresses of executable code, the stack, the heap, and shared libraries every time a process loads. The randomization makes it harder for an attacker who has achieved memory corruption — overwriting freed memory or overflowing a buffer — to predict where useful code exists in memory, which is necessary for reliable exploitation. When ASLR is present and working, a memory corruption bug may produce only a crash. When ASLR is absent, disabled, or bypassed, the same bug becomes a reliable code execution primitive.

Modern Linux servers have ASLR enabled by default, which is why F5's "ASLR disabled" language can seem like a narrow caveat. It is not. Orca Security explicitly warned during analysis of the prior NGINX Rift vulnerability that sophisticated exploitation techniques can combine heap corruption with memory disclosure vulnerabilities, heap grooming, or other environment-specific methods to bypass memory protection — without needing ASLR to be explicitly turned off. A public proof-of-concept exploit chain for CVE-2026-42945 demonstrated ASLR bypass via live worker memory reads, requiring no administrative disabling of ASLR in advance.

Kubernetes and containerized deployments face a compounding concern. NGINX runs as an ingress controller in the vast majority of Kubernetes clusters, and containerized workloads that kernel namespaces, run with elevated security profiles, or rely on reduced-entropy memory layouts can exhibit weakened ASLR protection. For organizations running NGINX as a Kubernetes ingress controller — exactly the high-value configuration the advisory flags — the ASLR caveat does not signal low risk. It signals a condition that is both present and potentially exploitable in production environments where NGINX is most densely deployed.

F5 has released fixes for the following products:

NGINX Open Source: update to version 1.31.2 for the mainline branch, or 1.30.3 for the stable branch. Both address CVE-2026-42055. Only 1.31.2 addresses CVE-2026-42530, as the HTTP/3 use-after-free was introduced in the 1.31.x branch.

NGINX Plus: update to 37.0.2.1 or R36 P6 for CVE-2026-42055 coverage.

NGINX Gateway Fabric: update to 2.6.4 , which addresses both critical CVEs plus two additional high-severity Gateway Fabric flaws — CVE-2026-11311 and CVE-2026-50107 — that allow authenticated attackers to inject arbitrary NGINX configuration directives, potentially exposing data from NGINX pod filesystems or redirecting traffic to attacker-controlled endpoints in Kubernetes deployments.

Several products in the NGINX ecosystem currently have no patches available. According to F5's advisory , NGINX Instance Manager, NGINX App Protect WAF, and F5 WAF for NGINX are all listed as affected but without fixes at the time of this advisory. Organizations running these products should apply temporary configuration mitigations immediately and monitor the advisory for updates.

For deployments where immediate patching is operationally difficult, F5 has published temporary workarounds.

For CVE-2026-42530 (HTTP/3 use-after-free): disable HTTP/3 support by removing the quic parameter from all listen directives in your NGINX configuration. This removes the vulnerable code path entirely.

For CVE-2026-42055 (HTTP/2 gRPC heap overflow): either remove the ignore_invalid_headers off directive from your configuration, or reduce the large_client_header_buffers directive size to below 2 MB. Either change eliminates the three-condition trigger required for exploitation.

These mitigations are functional stopgaps, not a substitute for patching. Organizations should treat them as a bridge to the maintenance window.

F5's advisory is explicit that neither CVE-2026-42530 nor CVE-2026-42055 has been confirmed as exploited in the wild at the time of publication. That confirmation lag should not be confused with safety. The last critical NGINX vulnerability of this severity class — CVE-2026-42945, branded NGINX Rift, disclosed May 13, 2026 — was confirmed as actively exploited by VulnCheck just three days later, on May 16, after the firm's canary honeypot systems detected targeted attack traffic.

The broader pattern is documented. Over the past several years, BleepingComputer reports that the U.S. Cybersecurity and Infrastructure Security Agency has flagged seven F5 vulnerabilities as actively exploited, with four of those specifically targeted in ransomware attacks. In October 2025, F5 disclosed that a China-nexus nation-state group had breached its internal BIG-IP development environment, stealing source code and information on undisclosed vulnerabilities — a breach CISA addressed with Emergency Directive 26-01. F5 confirmed that NGINX systems were not among the data accessed, but the incident underscores the sustained threat actor interest in F5's infrastructure products.

NGINX's role as a reverse proxy and API gateway makes any compromise of it particularly consequential. An attacker who gains code execution on an NGINX instance controls the proxy layer that brokers traffic between external clients and every backend service, internal API, and data store behind it — not just the web server itself.

Security teams should take the following steps immediately.

Identify all NGINX instances across your environment, including in containerized workloads, Kubernetes ingress controllers, and API gateways, where NGINX is often deployed as infrastructure rather than a named application and may be overlooked in manual inventories.

Determine which instances have HTTP/3 or HTTP/2 proxy configurations active. CVE-2026-42530 requires HTTP/3 with QUIC enabled. CVE-2026-42055 requires HTTP/2 backend proxying with both ignore_invalid_headers off and large_client_header_buffers above 2 MB.

Apply patches or temporary mitigations as described above. Do not wait for a scheduled maintenance window.

Verify that ASLR is enabled on all systems running NGINX. On Linux, confirm by checking /proc/sys/kernel/randomize_va_space — the value should be 2 for full randomization. Treat ASLR as defense-in-depth only, not a substitute for patching.

Monitor logs for repeated NGINX worker restarts, unusual QUIC or HTTP/2 traffic from unfamiliar sources, or crash patterns that suggest active probing.

Consult the full advisory details at SecurityWeek's coverage for version-specific guidance and updates on patches for currently unpatched products.

What versions of NGINX are affected by the June 2026 vulnerabilities?

CVE-2026-42530 (HTTP/3 use-after-free) affects NGINX Open Source versions 1.31.0 and 1.31.1 only. CVE-2026-42055 (HTTP/2 gRPC heap overflow) affects NGINX Open Source versions 1.13.10 through 1.31.1 — a range spanning more than a decade of releases — plus NGINX Plus R33 through 37.0.1. Both are fixed in NGINX Open Source 1.31.2; CVE-2026-42055 is also fixed in the stable-branch 1.30.3.

How do I patch NGINX now for these critical flaws?

For NGINX Open Source, upgrade to version 1.31.2 (mainline) or 1.30.3 (stable). For NGINX Plus, upgrade to 37.0.2.1 or R36 P6. For NGINX Gateway Fabric, upgrade to 2.6.4. If immediate patching is not possible, apply the temporary mitigations: remove the quic parameter from listen directives for CVE-2026-42530, and remove ignore_invalid_headers off or reduce large_client_header_buffers below 2 MB for CVE-2026-42055.

Does ASLR protect me from these vulnerabilities?

ASLR reduces the reliability of code execution exploits but does not prevent them. F5's advisory confirms that code execution is possible when ASLR is disabled or when an attacker can bypass it. Prior NGINX exploit research demonstrated ASLR bypass via live worker memory reads with no manual disabling required. Organizations running NGINX in containerized or Kubernetes environments should be especially cautious, as kernel namespace sharing and certain security profiles can reduce ASLR entropy below the protection level ASLR provides on bare-metal systems.

Why should I patch immediately if no exploitation has been confirmed?

The last critical NGINX vulnerability of this severity class, CVE-2026-42945, was exploited within three days of public disclosure. F5 products have been targeted in seven separately documented exploitation campaigns tracked by CISA, four of which involved ransomware. The out-of-band nature of this advisory — outside F5's regular quarterly schedule — signals that F5's security team assessed the risk as too urgent to wait for a scheduled release.