F5 Patches Two Critical NGINX Flaws in HTTP/3 and HTTP/2 Modules (CVE-2026-42530, CVE-2026-42055)

F 5 has released urgent patches for two critical vulnerabilities in its NGINX web server (CVE-2026-42530 and CVE-2026-42055), both rated with a CVSS v4.0 score of 9.2. The vulnerabilities could be exploited by unauthenticated attackers and are significant due to NGINX's widespread use across the internet. CVE-2026-42530 relates to a use-after-free flaw in HTTP/3 configurations, potentially leading to service denial; while CVE-2026-42055 is a heap-based buffer overflow affecting specific HTTP/2 configurations. Both security risks necessitate immediate upgrades to fixed versions or mitigations through configuration adjustments.