SecurityWeekIonut Arghire
F5 fixes NGINX heap overflow and iControl REST command injection
F5 on 14 May 2026 announced fixes for over 19 high-severity and 32 medium-severity vulnerabilities affecting BIG-IP, BIG-IQ, and NGINX. Based on CVSS scores, the most severe issue is CVE-2026-42945, a DoS in NGINX’s ngx_http_rewrite_module with a CVSS v4.0 score of 9.2 that could allow an unauthenticated attacker to trigger a heap overflow and a restart, potentially enabling code execution if ASLR is disabled.
The next notable flaw is CVE-2026-41225 (CVSS 8.6), a weakness in iControl REST that could enable a highly privileged attacker with at least Manager permissions to create configuration objects and execute commands. According to F5, fixes also cover high-severity RCE and remote command injection vulnerabilities (CVE-2026-41957, CVE-2026-34176, CVE-2026-39459) requiring authentication. None of the vulnerabilities appear to have been exploited in the wild, and more information is available in F5’s security notification.
Story timeline CVE-2026-42945
Full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Thu 14 May · 06:50 UTC | The Hacker News | NGINX Rift Bug Lets Attackers Run Code Remotely via Malicious URI |
| Thu 14 May · 10:57 UTC | SecurityWeek | F5 fixes NGINX heap overflow and iControl REST command injection (this article) |
| Thu 14 May · 12:31 UTC | SOCRadar | CVE-2026-42945: NGINX Rewrite Bug Allows Remote Code Execution |
| Thu 14 May · 14:30 UTC | Security Affairs | NGINX Rift flaw lets attackers run code with one HTTP request |
| Sat 16 May · 10:31 UTC | SecurityWeek | PoC Code Published for Critical NGINX Vulnerability |
| Sun 17 May · 15:01 UTC | The Hacker News | CVE-2026-42945 Exploit Seen In Wild, NGINX Users Urged To Patch |
| Mon 18 May · 07:21 UTC | Security Affairs | NGINX Rift flaw CVE-2026-42945 exploited despite ASLR mitigations |
| Mon 18 May · 08:01 UTC | SecurityWeek | Hackers Exploit NGINX Zero Day CVE-2026-42945 in Wild |