Blogfoon

Blogfoon is a personal space for thoughtful notes on technology, coding, travel, and ordinary life.

  • Published:

F5 has released an urgent NGINX update for two remote code execution vulnerabilities, CVE-2026-42530 and CVE-2026-42055, both rated 9.2 under CVSS v4. The flaws affect NGINX open source and several products built on it. Because NGINX is widely used as a web server, reverse proxy, and microservices gateway, the advisory has drawn close attention from security teams. An unauthenticated remote attacker who meets the exploit conditions could, in the worst case, gain full control of an affected system.

The two flaws

CVE-2026-42530: use-after-free in HTTP/3 QUIC

The first vulnerability sits in ngx_http_v3_module, the module that provides HTTP/3 and QUIC support. It is a use-after-free, a memory corruption bug in which a program keeps using a pointer after the memory it points to has been freed. An attacker can trigger it by sending a crafted HTTP/3 session and manipulating the QPACK encoding stream's 'reopen' operation, causing NGINX to access memory illegally.

The bug is reachable when an NGINX open source build has the HTTP/3 QUIC module enabled. Successful exploitation also requires address space layout randomization (ASLR) to be disabled or bypassed. ASLR is a key operating system defense against memory corruption attacks. If those conditions are met, the attacker can achieve arbitrary code execution and take over the server.

CVE-2026-42055: heap buffer overflow in HTTP/2 and gRPC proxying

The second vulnerability is a heap buffer overflow in ngx_http_proxy_v2_module and ngx_http_grpc_module. It occurs when data written to heap memory exceeds the intended buffer size, potentially overwriting adjacent memory and hijacking program execution.

Exploitation depends on a specific configuration. The server must handle HTTP/2 traffic through proxy_http_version 2 or grpc_pass, ignore_invalid_headers must be set to off, and large_client_header_buffers must be configured above 2 MB. In that non-standard setup, a malicious request can trigger the overflow. As with CVE-2026-42530, exploitation also depends on ASLR being disabled or bypassed, and a successful attack can lead to remote code execution.

Affected versions and fixes

CVE-2026-42530

  • NGINX open source: affected 1.31.0–1.31.1; fixed in 1.31.2.
  • NGINX Gateway Fabric: affected 2.0.0–2.6.3; fixed in 2.6.4. Versions 1.3.0–1.6.2 are also listed as affected.
  • NGINX Ingress Controller: affected 5.0.0–5.5.0, 4.0.0–4.0.1, and 3.5.0–3.7.2.
  • NGINX Instance Manager: affected 2.17.0–2.22.0.

CVE-2026-42055

  • NGINX Plus: affected 37.0.0–37.0.1; fixed in 37.0.2.1. Versions R33–R36 are affected; fixed in R36 P6.
  • NGINX open source: affected 1.31.x, specifically 1.31.1; fixed in 1.31.2. Versions 1.30.0–1.30.2 are affected; fixed in 1.30.3.
  • F5 WAF for NGINX: affected 5.9.0–5.13.1.
  • NGINX App Protect WAF / DoS: affected WAF versions 5.2.0–5.8.0 and 4.10.0–4.16.0; affected DoS versions 4.3.0–4.7.0.
  • NGINX Ingress Controller and Gateway Fabric: the advisory points to the same product ranges as CVE-2026-42530, including Ingress Controller 3.5.0–5.5.0 and Gateway Fabric 1.3.0–2.6.3. Gateway Fabric 2.6.4 is fixed.

Temporary mitigations

For systems that cannot be updated immediately, F5 provided workarounds.

For CVE-2026-42530, disable HTTP/3 explicitly. Comment out or remove the relevant listen ... quic directive so the vulnerable attack surface is closed.

For CVE-2026-42055, apply either of these changes:

  • Remove ignore_invalid_headers off from the NGINX configuration, restoring the default header validation behavior.
  • Lower large_client_header_buffers to 2 MB or less, for example large_client_header_buffers 4 512k, so the overflow condition is not met.

Why rapid action matters

At the time of the advisory, F5 had not publicly reported evidence that CVE-2026-42530 or CVE-2026-42055 were being widely exploited in the wild. That does not make the situation safe to defer.

In January 2026, another high-severity flaw affecting NGINX Plus and open source, CVE-2026-42945, also scored 9.2 and was nicknamed 'NGINX Rift'. After technical details became public, attackers began exploiting it within days. The pattern shows how quickly malicious actors respond to NGINX vulnerabilities and how short the window can be between disclosure and automated scanning or exploit tooling.

With both new flaws rated 9.2, arriving close to NGINX Rift, and affecting software at the core of internet infrastructure, affected operators should treat this as a top-priority security event. Upgrading to the fixed release or applying the workaround is the most direct way to reduce exposure. Security teams should also keep watching F5 advisories and major security research for possible follow-on threats.

Related Posts