Loading story…
F5 disclosed multiple high-severity vulnerabilities affecting NGINX Open Source, NGINX Plus, and related products, including a critical heap-based buffer overflow in ngx_http_proxy_v2_module and ngx_http_grpc_module tracked as CVE-2026-42055. The flaw can be triggered remotely without authentication when HTTP/2 proxying or grpc_pass is enabled, ignore_invalid_headers is set to off, and large_client_header_buffers exceeds 2 MB, allowing oversized headers to crash worker processes and potentially enable code execution if ASLR is bypassed. F5 also disclosed CVE-2026-42530, a critical use-after-free in the open-source ngx_http_v3_module that can be exploited through a crafted HTTP/3 QUIC session to reopen a QPACK encoder stream, again causing worker restarts and possible code execution.
A separate issue, CVE-2026-11311, affects NGINX Gateway Fabric when NGINX Plus is used as the data plane, allowing authenticated users with permission to modify relevant CRDs to inject arbitrary NGINX directives through unsanitized values in NginxProxy.serverTokens and AuthenticationFilter.extraAuthArgs. F5's out-of-band advisory said the exposure spans a broad set of products, including NGINX Ingress Controller, NGINX Instance Manager, NGINX App Protect WAF, NGINX App Protect DoS, F5 WAF for NGINX Instance Manager, and F5 DoS for NGINX. Updated releases, including nginx 1.31.2 and the stable branch 1.30.3, were published to address the core NGINX flaws, and defenders were urged to patch affected versions or disable HTTP/3 QUIC where immediate updates are not possible.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
F5 fixed the NGINX Gateway Fabric vulnerabilities CVE-2026-11311 and CVE-2026-50107 in version 2.6.4. The update addresses high-severity configuration injection issues affecting deployments using NGINX Plus or NGINX Open Source as the data plane.
A high-severity injection vulnerability, CVE-2026-50107, was published for NGINX Gateway Fabric affecting deployments that use NGINX Plus or NGINX Open Source as the data plane. The flaw in the configuration generator lets an authenticated attacker who can modify NginxProxy CRDs inject arbitrary NGINX directives through unsanitized access log format values.
F5 published an out-of-band security advisory covering vulnerabilities across multiple F5 and NGINX products, including NGINX Open Source, NGINX Plus, NGINX Gateway Fabric, NGINX Ingress Controller, and several App Protect and WAF offerings. The Canadian Centre for Cyber Security relayed the notice and urged administrators to review the advisory and apply updates.
A high-severity injection vulnerability, CVE-2026-11311, was published for NGINX Gateway Fabric when NGINX Plus is used as the data plane. The issue lets an authenticated attacker with permission to modify certain CRDs inject arbitrary NGINX configuration directives through unsanitized user-supplied values.
A critical vulnerability, CVE-2026-42530, was published affecting the NGINX Open Source ngx_http_v3_module when HTTP/3 QUIC is enabled. A specially crafted HTTP/3 session can reopen a QPACK encoder stream and trigger a use-after-free in the worker process, potentially causing restarts and possible code execution.
A critical vulnerability, CVE-2026-42055, was published affecting NGINX Plus and NGINX Open Source when HTTP/2 proxying or grpc_pass is used with ignore_invalid_headers set to off and large_client_header_buffers above 2 MB. The flaw allows a remote unauthenticated attacker to trigger a heap-based buffer overflow that can restart worker processes and may enable code execution under certain conditions.
The nginx project released nginx 1.31.2 and the stable branch update nginx 1.30.3 to address several security issues, including CVE-2026-42530 and CVE-2026-42055. The release also fixed CVE-2026-48142 and introduced unrelated functional changes such as a new $ssl_sigalgs variable and SipHash-2-4 for $request_id generation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
20 references tracked. Mallory keeps watching after this page renders.
hkcert.org
Open sourcesocprime.com
Open sourcethecybersecguru.com
Open sourcesecurityonline.info
Open sourcemy.f5.com
Open sourcecve.org
Open sourcecvefeed.io
Open sourceopennet.ru
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
F5 disclosed and patched multiple NGINX vulnerabilities, including the high-severity `CVE-2026-32647` in `ngx_http_mp4_module`, which affects both **NGINX Open Source** and **NGINX Plus**. The flaw is an out-of-bounds read memory corruption issue triggered when NGINX processes a specially crafted MP4 file, allowing a local authenticated attacker to crash worker processes in the data plane and potentially achieve arbitrary code execution. F5 said the control plane is not affected and credited Xint Code and Pavel Kohout of Aisle Research with the discovery and coordinated disclosure. The vulnerable condition impacts deployments using the `mp4` directive with `ngx_http_mp4_module` enabled; the module is included by default in NGINX Plus, while NGINX Open Source requires it to be explicitly compiled and enabled. F5 also published advisories for `CVE-2026-27654` in `ngx_http_dav_module` and `CVE-2026-28755` in `ngx_stream_ssl_module`, indicating a broader set of NGINX fixes released together. The company issued patched versions for affected NGINX Plus and Open Source releases and advised organizations that cannot patch immediately to disable the MP4 module and limit media publishing to trusted users.
Jun 29, 2026
F5 and NGINX disclosed **CVE-2026-42945** ("**NGINX Rift**"), a critical heap buffer overflow in `ngx_http_rewrite_module` affecting **NGINX Open Source 0.6.27 through 1.30.0** and **NGINX Plus R32 through R36**. The bug is exposed when servers use a specific rewrite pattern: a `rewrite` directive with unnamed PCRE captures such as `$1` or `$2`, a replacement string containing `?`, and a following `rewrite`, `if`, or `set` directive. An unauthenticated attacker can send crafted HTTP requests to corrupt heap memory in the worker process, reliably causing crashes and restarts; code execution is considered possible in weaker environments, particularly where **ASLR is disabled**. Fixes were released in **NGINX 1.30.1**, **1.31.0**, and patched NGINX Plus builds, while Debian, AlmaLinux, and other downstream vendors began shipping updates. Public writeups and proof-of-concept code quickly drove attacker interest, and multiple reports said **VulnCheck observed exploitation attempts on canary systems** within days of disclosure. Researchers and defenders broadly agreed that denial-of-service is the most practical near-term impact, while widespread reliable RCE is less likely on hardened systems with modern memory protections enabled. Administrators were urged to patch internet-facing reverse proxies, load balancers, ingress controllers, and API gateways, audit rewrite rules for unnamed captures, and use named captures as a temporary mitigation where upgrades cannot be applied immediately. The same release cycle also addressed additional NGINX flaws including **CVE-2026-42946**, **CVE-2026-40701**, and **CVE-2026-42934**.
Jun 29, 2026
German government CERT advisories report multiple vulnerabilities in **NGINX** and **NGINX Plus** that can be exploited for **denial of service**, with a newer notice warning that affected **NGINX Open Source** and **NGINX Plus** deployments may also face **potential code execution**. The advisories indicate that the issues affect both the commercial and open source product lines, expanding the risk beyond service disruption alone. The earlier advisory described multiple flaws enabling service outages in NGINX and NGINX Plus, while the later advisory escalated the impact to include possible remote code execution in addition to denial of service. Organizations running internet-facing NGINX infrastructure should review the referenced dCERT notices, identify exposed versions across reverse proxies, load balancers, and web servers, and prioritize vendor-recommended updates or mitigations.
Jun 29, 2026