F5 Patches Critical NGINX Flaws Enabling Remote Code Execution

F5 has issued out-of-band security updates to remediate two critical-severity vulnerabilities in its NGINX web server software that could allow unauthenticated remote attackers to execute arbitrary code or trigger denial-of-service conditions. The flaws—tracked as CVE-2026-42530 in the ngx_http_v3_module and CVE-2026-42055 in the ngx_http_proxy_module—stem from use-after-free and heap-based buffer overflow bugs that corrupt the NGINX worker process, forcing a restart. F5 warned that attackers could escalate these memory-corruption bugs into full code execution on systems where Address Space Layout Randomization (ASLR) is disabled or where ASLR bypass techniques succeed.

The patches cover NGINX Plus, NGINX Open Source, NGINX Gateway Fabric, and NGINX Instance Manager. Organizations unable to apply the fixes immediately can mitigate CVE-2026-42530 by disabling HTTP/3 (removing the quic directive from all listen blocks) and mitigate CVE-2026-42055 by toggling the ignore_invalid_headers off directive and reducing the large_client_header_buffers directive below 2 megabytes. F5 also resolved two high-severity NGINX Gateway Fabric bugs—CVE-2026-11311 and CVE-2026-50107—that permit authenticated attackers to inject arbitrary NGINX configuration directives, potentially altering proxy or load-balancing behavior without authorization. Admins managing these deployments should verify their TLS termination posture using a reliable SSL/TLS checker and scan exposed endpoints with a port scanner to confirm no unexpected services are reachable.

Although F5 has not observed active exploitation of these specific flaws, the company's products remain a high-value target. State-sponsored actors breached F5 systems in August 2025, stealing undisclosed BIG-IP vulnerabilities and source code, and CISA has previously flagged at least seven F5 CVEs as actively exploited, four of them in ransomware campaigns. Threat groups have historically used F5 flaws to deploy data-wiping malware, map internal networks, and exfiltrate sensitive documents from Fortune 500 enterprises. Defenders should prioritize patching, audit NGINX configurations for the listed mitigations, and review perimeter exposures—starting with a WHOIS lookup on any suspicious infrastructure tied to recent F5-related intrusion attempts.