F5 released out-of-band security updates to address multiple NGINX web server vulnerabilities. These updates provide fixes for NGINX Plus, NGINX Open Source, NGINX Gateway Fabric, and NGINX Instance Manager.

The updates resolve two critical-severity vulnerabilities, CVE-2026-42530 and CVE-2026-42055, which both received a CVSS score of 9.2. Unauthenticated remote attackers can exploit these critical vulnerabilities to trigger a denial-of-service condition or execute code on NGINX systems that have non-default configurations. Successful exploitation of these vulnerabilities leads to a use-after-free or heap-based buffer overflow within the NGINX worker process, causing a restart.

CVE-2026-42530 specifically affects the ngx_http_v3_module, while CVE-2026-42055 affects the ngx_http_proxy_v2_module and ngx_http_grpc_module. Attackers can execute arbitrary code on systems where Address Space Layout Randomization is disabled or can be bypassed. Administrators can mitigate CVE-2026-42530 by disabling HTTP/3. For CVE-2026-42055, mitigation involves removing the ignore_invalid_headers off directive and reducing the large_client_header_buffers directive size to below 2 megabytes.

F5 also patched two high-severity vulnerabilities in NGINX Gateway Fabric, identified as CVE-2026-11311 and CVE-2026-50107. Authenticated attackers can exploit these to inject arbitrary configuration directives. F5 stated, "Successful exploitation may allow the attacker to expose sensitive data from the NGINX pod filesystem, proxy traffic to attacker-controlled endpoints, or cause a denial-of-service condition by injecting configuration that prevents NGINX from reloading."

Additionally, F5 announced patches for two medium-severity NGINX vulnerabilities. These vulnerabilities could allow remote attackers to disclose memory contents or restart the NGINX worker process. F5 did not report that any of the newly disclosed NGINX vulnerabilities are being actively exploited. F5 is a Fortune 500 technology company that provides cybersecurity and application delivery networking services to over 23,000 customers worldwide. Cybercrime and nation-state threat groups have targeted F5 product vulnerabilities in recent years to breach networks, deploy malware, and steal data.