F5 Patches Two Critical NGINX Flaws Enabling Remote Code Execution

F5 has issued security updates addressing two critical vulnerabilities in NGINX Open Source, both carrying a CVSS v4 score of 9.2. Security teams running NGINX across enterprise web infrastructure should treat this as an urgent patch priority.

• The first flaw, CVE-2026-42530, is a use-after-free vulnerability in NGINX's HTTP/3 QUIC module. A remote unauthenticated attacker can trigger it by crafting a specially constructed HTTP/3 session that causes the QPACK encoder stream to be reopened. Successful exploitation allows arbitrary code execution on systems where Address Space Layout Randomisation (ASLR) is disabled or where an attacker can bypass ASLR protections. The vulnerability affects NGINX Open Source versions 1.31.0 through 1.31.1, fixed in version 1.31.2, as well as multiple NGINX Gateway Fabric, NGINX Instance Manager, and NGINX Ingress Controller versions.
• The second flaw, CVE-2026-42055, is a heap-based buffer overflow in NGINX's HTTP/2 proxy and gRPC modules. It can be triggered when specific configuration conditions are met: the proxy is handling HTTP/2 traffic, the ignore_invalid_headers directive is set to off, and the large_client_header_buffers directive is set above 2 MB. Like the first vulnerability, code execution is achievable on systems with ASLR disabled or bypassed. This flaw affects NGINX Plus R33 through R36, NGINX Open Source 1.31.1 and 1.30.0 through 1.30.2, F5 WAF for NGINX, and several NGINX App Protect and Ingress Controller versions.

F5 has outlined interim mitigations for both flaws pending patch deployment. For CVE-2026-42530, disabling HTTP/3 removes the attack surface. For CVE-2026-42055, removing the ignore_invalid_headers off directive from the configuration, or reducing the large_client_header_buffers directive size to below 2 MB, closes the exposure path.

Security teams should note that F5 products have a documented history of rapid exploitation following public disclosure. As recently as last month, a separate critical NGINX flaw tracked as CVE-2026-42945 and referred to as NGINX Rift came under active exploitation within days of its public release. That pattern reinforces the urgency of applying the current patches before proof-of-concept code circulates.

NGINX is one of the most widely deployed web server and reverse proxy platforms in the world, with significant adoption across GCC enterprise and government infrastructure. Its use as a front-end load balancer, API gateway, and application delivery controller means that a successful exploit against an unpatched instance can expose significant portions of an organisation's application layer.

F5 has confirmed no active exploitation of CVE-2026-42530 or CVE-2026-42055 at the time of writing, but given the severity scores and the availability of interim mitigations, there is no justification for delay. Organisations running affected versions should apply patches immediately and enable interim mitigations as a bridge where patching cannot be completed at once.

Full affected version lists and patched builds are documented in the F5 security advisory. Enterprise teams that have already been tracking the broader wave of vendor-level security events this quarter will recognise this as part of a sustained period of critical infrastructure vulnerability disclosure that is compressing patch timelines across the industry.