Skip to content
OriginalSign in
Image: Security Affairs

Security AffairsPierluigi Paganini

F5 Patches Critical NGINX Vulnerabilities Enabling Unauthenticated Code Execution

Part of the CVE-2026-42530 story · since 18 Jun

Quiet for 14 weekslast report 30 Jul5 articles4 outlets
18 Jun · SecurityWeek first28 Aug21 SepNowThis article2nd of 5
  • Thu 18 Jun, 09:54 UTC. SecurityWeek, first report. F5 patches NGINX remote code flaws CVE-2026-42530, CVE-2026-42055.
  • Thu 18 Jun, 15:11 UTC. Security Affairs, its first report on the story. F5 Patches Critical NGINX Vulnerabilities Enabling Unauthenticated Code Execution. This article, 2nd of 5.
  • Fri 19 Jun, 03:31 UTC. SecurityOnline, its first report on the story. F5 Patches Two Critical NGINX Flaws in HTTP/3 and HTTP/2 Modules (CVE-2026-42530, CVE-2026-42055).
  • Fri 19 Jun, 14:02 UTC. SOCRadar, its first report on the story. F5 releases patches for critical NGINX HTTP/3 and HTTP/2 flaws.
  • Thu 30 Jul, 15:07 UTC. SecurityOnline. CVE-2026-42530: NGINX HTTP/3 flaw allows remote code execution.

F5 has released urgent updates to address critical vulnerabilities in NGINX, specifically CVE-2026-42530 and CVE-2026-42055, both rated at CVSS 9.2. The first vulnerability allows unauthenticated code execution through a Use-After-Free condition in the ngx_http_v3_module, exploitable via specially crafted HTTP/3 sessions.

The second vulnerability is a heap-based buffer overflow in the ngx_http_proxy_v2_module and ngx_http_grpc_module, which can be exploited by sending oversized headers in non-default configurations. Both vulnerabilities pose risks of denial-of-service (DoS) and potential code execution; however, default installations are not affected. F5 also addressed two other high-severity vulnerabilities in NGINX Gateway Fabric but reports no known exploitation of the identified issues.

How the story developed

All 5 articles
Quiet for 14 weekslast report 30 Jul5 articles4 outlets

5 articles from 4 outlets since 18 Jun. Quiet since 30 Jul. This was the 2nd report, 5 hours after the first.

Now18 Jun19202129 Jul311 NovFirst reportSecurityWeek · 18 Jun, 09:54This article2nd of 5 · day 0Picked up againafter 6 weeks quiet
  • Thu 18 Jun, 09:54 UTC. SecurityWeek, first report. F5 patches NGINX remote code flaws CVE-2026-42530, CVE-2026-42055.
  • Thu 18 Jun, 15:11 UTC. Security Affairs, its first report on the story. F5 Patches Critical NGINX Vulnerabilities Enabling Unauthenticated Code Execution. This article, 2nd of 5.
  • Fri 19 Jun, 03:31 UTC. SecurityOnline, its first report on the story. F5 Patches Two Critical NGINX Flaws in HTTP/3 and HTTP/2 Modules (CVE-2026-42530, CVE-2026-42055).
  • Fri 19 Jun, 14:02 UTC. SOCRadar, its first report on the story. F5 releases patches for critical NGINX HTTP/3 and HTTP/2 flaws.
  • Thu 30 Jul, 15:07 UTC. SecurityOnline. CVE-2026-42530: NGINX HTTP/3 flaw allows remote code execution.
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 5 articles as a list
  1. Thu 18 JunDay 02
    1. F5 patches NGINX remote code flaws CVE-2026-42530, CVE-2026-4205509:54 · SecurityWeek · First report
    2. F5 Patches Critical NGINX Vulnerabilities Enabling Unauthenticated Code Execution15:11 · Security Affairs · This article, 2nd of 5
  2. Fri 19 JunDay 12
    1. F5 Patches Two Critical NGINX Flaws in HTTP/3 and HTTP/2 Modules (CVE-2026-42530, CVE-2026-42055)03:31 · SecurityOnline
    2. F5 releases patches for critical NGINX HTTP/3 and HTTP/2 flaws14:02 · SOCRadar

  3. Quiet for 6 weeks

    Thu 30 JulDay 421
    1. CVE-2026-42530: NGINX HTTP/3 flaw allows remote code execution15:07 · SecurityOnline · Picked up again

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in