Skip to content
OriginalSign in
Image: SecurityWeek

SecurityWeekIonut Arghire

F5 patches NGINX remote code flaws CVE-2026-42530, CVE-2026-42055

Part of the CVE-2026-42530 story · since 18 Jun

Quiet for 14 weekslast report 30 Jul5 articles4 outlets
18 Jun · SecurityWeek first28 Aug21 SepNowThis article1st of 5
  • Thu 18 Jun, 09:54 UTC. SecurityWeek, first report. F5 patches NGINX remote code flaws CVE-2026-42530, CVE-2026-42055. This article, 1st of 5.
  • Thu 18 Jun, 15:11 UTC. Security Affairs, its first report on the story. F5 Patches Critical NGINX Vulnerabilities Enabling Unauthenticated Code Execution.
  • Fri 19 Jun, 03:31 UTC. SecurityOnline, its first report on the story. F5 Patches Two Critical NGINX Flaws in HTTP/3 and HTTP/2 Modules (CVE-2026-42530, CVE-2026-42055).
  • Fri 19 Jun, 14:02 UTC. SOCRadar, its first report on the story. F5 releases patches for critical NGINX HTTP/3 and HTTP/2 flaws.
  • Thu 30 Jul, 15:07 UTC. SecurityOnline. CVE-2026-42530: NGINX HTTP/3 flaw allows remote code execution.

F5 has released critical security updates for multiple NGINX vulnerabilities, including CVE-2026-42530 and CVE-2026-42055, both with a CVSS score of 9.2. These flaws can lead to code execution and denial-of-service (DoS) conditions. Exploiting these vulnerabilities requires no authentication. Additional patches were also issued for CVE-2026-11311 and CVE-2026-50107, affecting NGINX Gateway Fabric, which could allow configuration manipulation by authenticated attackers. While there have been no reports of exploitation in the wild, users are strongly advised to update their systems due to increasing attack risks.

How the story developed

All 5 articles
Quiet for 14 weekslast report 30 Jul5 articles4 outlets

5 articles from 4 outlets since 18 Jun. Quiet since 30 Jul. This was the first report.

Now18 Jun19202129 Jul311 NovFirst reportSecurityWeek · 18 Jun, 09:54Picked up againafter 6 weeks quiet
  • Thu 18 Jun, 09:54 UTC. SecurityWeek, first report. F5 patches NGINX remote code flaws CVE-2026-42530, CVE-2026-42055. This article, 1st of 5.
  • Thu 18 Jun, 15:11 UTC. Security Affairs, its first report on the story. F5 Patches Critical NGINX Vulnerabilities Enabling Unauthenticated Code Execution.
  • Fri 19 Jun, 03:31 UTC. SecurityOnline, its first report on the story. F5 Patches Two Critical NGINX Flaws in HTTP/3 and HTTP/2 Modules (CVE-2026-42530, CVE-2026-42055).
  • Fri 19 Jun, 14:02 UTC. SOCRadar, its first report on the story. F5 releases patches for critical NGINX HTTP/3 and HTTP/2 flaws.
  • Thu 30 Jul, 15:07 UTC. SecurityOnline. CVE-2026-42530: NGINX HTTP/3 flaw allows remote code execution.
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 5 articles as a list
  1. Thu 18 JunDay 02
    1. F5 patches NGINX remote code flaws CVE-2026-42530, CVE-2026-4205509:54 · SecurityWeek · First report · This article, 1st of 5
    2. F5 Patches Critical NGINX Vulnerabilities Enabling Unauthenticated Code Execution15:11 · Security Affairs
  2. Fri 19 JunDay 12
    1. F5 Patches Two Critical NGINX Flaws in HTTP/3 and HTTP/2 Modules (CVE-2026-42530, CVE-2026-42055)03:31 · SecurityOnline
    2. F5 releases patches for critical NGINX HTTP/3 and HTTP/2 flaws14:02 · SOCRadar

  3. Quiet for 6 weeks

    Thu 30 JulDay 421
    1. CVE-2026-42530: NGINX HTTP/3 flaw allows remote code execution15:07 · SecurityOnline · Picked up again

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in