Skip to content
OriginalSign in
Image: SOCRadar

SOCRadarAmeer Owda

F5 releases patches for critical NGINX HTTP/3 and HTTP/2 flaws

Part of the CVE-2026-42530 story · since 18 Jun

Quiet for 14 weekslast report 30 Jul5 articles4 outlets
18 Jun · SecurityWeek first28 Aug21 SepNowThis article4th of 5
  • Thu 18 Jun, 09:54 UTC. SecurityWeek, first report. F5 patches NGINX remote code flaws CVE-2026-42530, CVE-2026-42055.
  • Thu 18 Jun, 15:11 UTC. Security Affairs, its first report on the story. F5 Patches Critical NGINX Vulnerabilities Enabling Unauthenticated Code Execution.
  • Fri 19 Jun, 03:31 UTC. SecurityOnline, its first report on the story. F5 Patches Two Critical NGINX Flaws in HTTP/3 and HTTP/2 Modules (CVE-2026-42530, CVE-2026-42055).
  • Fri 19 Jun, 14:02 UTC. SOCRadar, its first report on the story. F5 releases patches for critical NGINX HTTP/3 and HTTP/2 flaws. This article, 4th of 5.
  • Thu 30 Jul, 15:07 UTC. SecurityOnline. CVE-2026-42530: NGINX HTTP/3 flaw allows remote code execution.

F5 has issued urgent patches for two critical vulnerabilities in NGINX: CVE-2026-42530 and CVE-2026-42055. CVE-2026-42530, categorized as a major-severity use-after-free vulnerability in NGINX's HTTP/3 implementation, affects versions 1.31.0 to 1.31.1, allowing remote attackers to restart processes and potentially execute code. CVE-2026-42055 is a medium-severity heap-based buffer overflow affecting HTTP/2 and gRPC proxying, impacting versions 1.13.10 to 1.31.1.

Security risks include Denial-of-Service (DoS) and Remote Code Execution (RCE). Organizations should upgrade to NGINX 1.31.2 or 1.30.3, limit exposure, and monitor for unusual activities related to these vulnerabilities. At present, there are no confirmed reports of in-the-wild exploitation.

How the story developed

All 5 articles
Quiet for 14 weekslast report 30 Jul5 articles4 outlets

5 articles from 4 outlets since 18 Jun. Quiet since 30 Jul. This was the 4th report, 1 day after the first.

Now18 Jun19202129 Jul31First reportSecurityWeek · 18 Jun, 09:54This article4th of 5 · day 1Picked up againafter 6 weeks quiet
  • Thu 18 Jun, 09:54 UTC. SecurityWeek, first report. F5 patches NGINX remote code flaws CVE-2026-42530, CVE-2026-42055.
  • Thu 18 Jun, 15:11 UTC. Security Affairs, its first report on the story. F5 Patches Critical NGINX Vulnerabilities Enabling Unauthenticated Code Execution.
  • Fri 19 Jun, 03:31 UTC. SecurityOnline, its first report on the story. F5 Patches Two Critical NGINX Flaws in HTTP/3 and HTTP/2 Modules (CVE-2026-42530, CVE-2026-42055).
  • Fri 19 Jun, 14:02 UTC. SOCRadar, its first report on the story. F5 releases patches for critical NGINX HTTP/3 and HTTP/2 flaws. This article, 4th of 5.
  • Thu 30 Jul, 15:07 UTC. SecurityOnline. CVE-2026-42530: NGINX HTTP/3 flaw allows remote code execution.
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 5 articles as a list
  1. Thu 18 JunDay 02
    1. F5 patches NGINX remote code flaws CVE-2026-42530, CVE-2026-4205509:54 · SecurityWeek · First report
    2. F5 Patches Critical NGINX Vulnerabilities Enabling Unauthenticated Code Execution15:11 · Security Affairs
  2. Fri 19 JunDay 12
    1. F5 Patches Two Critical NGINX Flaws in HTTP/3 and HTTP/2 Modules (CVE-2026-42530, CVE-2026-42055)03:31 · SecurityOnline
    2. F5 releases patches for critical NGINX HTTP/3 and HTTP/2 flaws14:02 · SOCRadar · This article, 4th of 5

  3. Quiet for 6 weeks

    Thu 30 JulDay 421
    1. CVE-2026-42530: NGINX HTTP/3 flaw allows remote code execution15:07 · SecurityOnline · Picked up again

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in