F5 has issued urgent patches for two critical vulnerabilities in NGINX that could allow unauthenticated attackers to execute code or cause denial‑of‑service conditions. The flaws, tracked as CVE‑2026‑42530 and CVE‑2026‑42055, affect widely deployed HTTP/2 and HTTP/3 modules and were disclosed in an advisory published on the F5 support portal here. Given NGINX’s role as a front‑end for countless web services, the updates are essential for organisations seeking to limit exposure to remote compromise.
CVE‑2026‑42530 is a use‑after‑free error in the ngx_http_v3_module that impacts NGINX core versions 1.31.0 through 1.31.1. An attacker who can send specially crafted HTTP/3 packets may trigger a process restart or achieve remote code execution without needing any credentials. CVE‑2026‑42055 is a heap‑based buffer overflow in the ngx_http_proxy_v2_module and ngx_http_grpc_module, affecting NGINX releases from 1.13.10 up to 1.31.1; it can be exploited by oversized headers in non‑default HTTP/2 or gRPC proxy configurations, potentially leading to service disruption or code execution.
In the same advisory F5 also addressed two higher‑severity issues in NGINX Gateway Fabric, identified as CVE‑2026‑11311 and CVE‑2026‑50107, each carrying a CVSS score of 8.6. Those vulnerabilities require authenticated access and relate to manipulation of gateway configuration, but no exploitation has been observed in the wild. The vendor stresses that, while the HTTP/2 and HTTP/3 flaws are critical, default installations that do not enable the affected modules remain unaffected.
To date there are no confirmed reports of either CVE‑2026‑42530 or CVE‑2026‑42055 being used in active attacks, according to F5 and the security researchers who have analysed the disclosures. However, the combination of a high CVSS rating, lack of authentication requirement and the prevalence of NGINX in edge deployments makes these issues attractive targets for automated scanning campaigns once proof‑of‑concept code becomes available.
Defenders should prioritise upgrading to NGINX 1.31.2 or, for those on the long‑term support track, to version 1.30.3, as specified in the F5 advisory here. If immediate patching is not feasible, administrators can disable HTTP/3 support, limit HTTP/2 and gRPC proxying to trusted networks, and enforce strict header size limits at the edge or via a web application firewall.
Beyond patching, it is advisable to review which NGINX modules are actually needed, disable any that are unnecessary, and segment management interfaces from public traffic. Continuous monitoring of error logs for unexpected process restarts or abnormal header lengths can help detect attempted exploitation. Maintaining an inventory of exposed NGINX instances and subscribing to vendor security notices will ensure that future updates are applied promptly.