Is Your NGINX Server Truly Secure? F5 Warns of Critical Vulnerabilities That Could Lead to Remote Code Execution!

F5 has issued an official security advisory regarding several high-risk vulnerabilities affecting NGINX Plus and NGINX Open Source. According to security experts, successful exploitation of these vulnerabilities could result in memory corruption, denial of service (DoS), and, in certain cases, remote code execution (RCE).

The identified vulnerabilities affect widely deployed components, including NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, NGINX App Protect WAF, and NGINX Instance Manager. Since these products are extensively used to power internet-facing web applications, API services, container platforms, and cloud environments, security professionals strongly recommend applying the available updates without delay.

Most Critical Vulnerability — CVE-2026-42533

The most severe vulnerability identified is CVE-2026-42533, which has been assigned a CVSS v3.1 score of 8.1 and a CVSS v4.0 score of 9.2.

This vulnerability is a Heap Buffer Overflow caused by a logic flaw in the way NGINX processes the map directive and regular expressions (regex).

By sending specially crafted HTTP requests, an attacker can corrupt the memory of an NGINX Worker Process.

Successful exploitation may result in:

  • Crashing the NGINX service;
  • Causing Worker Processes to terminate unexpectedly;
  • Memory corruption;
  • Remote execution of arbitrary code on systems where Address Space Layout Randomization (ASLR) is absent or has been bypassed.

As a temporary mitigation, F5 recommends using named regex captures instead of unnamed regex captures.

CVE-2026-60005 — Information Disclosure from Uninitialized Memory

The second vulnerability, CVE-2026-60005, has received a CVSS v3.1 score of 8.2 and a CVSS v4.0 score of 8.8.

The issue exists in the ngx_http_slice_module, which is not enabled by default and is only available in systems compiled with a specific build option.

Successful exploitation may lead to:

  • Disclosure of data from uninitialized memory;
  • Leakage of limited amounts of sensitive information;
  • Restarting of an NGINX Worker Process.

F5 also recommends using named regex captures as a mitigation for this issue.

CVE-2026-56434 — Use-After-Free Vulnerability

The third vulnerability, CVE-2026-56434, is classified as a Use-After-Free vulnerability.

The issue affects the ngx_http_ssi_module.

If the following conditions are met:

  • Server-Side Includes (SSI) is enabled;
  • proxy_pass is being used;
  • proxy_buffering off is configured,

then a Man-in-the-Middle (MitM) attacker may manipulate responses from the upstream server, triggering a memory-related error.

Possible consequences include:

  • Denial of service;
  • Partial memory corruption;
  • Crashing of an NGINX Worker Process.

There is currently no workaround for this vulnerability. Applying the security updates is the only effective mitigation.

Affected Products

The vulnerabilities affect the following products:

  • NGINX Plus 37.x;
  • NGINX Open Source 1.x;
  • NGINX Ingress Controller;
  • NGINX Gateway Fabric;
  • NGINX App Protect WAF;
  • NGINX Instance Manager.

The vulnerabilities have been fixed in:

  • NGINX Plus 37.0.3.1;
  • NGINX Open Source 1.31.3;
  • NGINX Open Source 1.30.4.

Security updates for Ingress Controller, Gateway Fabric, App Protect WAF, and Instance Manager are also being released progressively.

F5 also emphasized that the following products are not affected by these vulnerabilities:

  • BIG-IP;
  • BIG-IQ;
  • F5 Distributed Cloud;
  • F5OS;
  • F5 AI Gateway.

The vulnerabilities impact only NGINX Data Plane components.

Why Are These Vulnerabilities So Important?

Today, NGINX is one of the world’s most widely used web servers and reverse proxy solutions.

It powers millions of:

  • Websites;
  • REST APIs;
  • Kubernetes clusters;
  • Microservices;
  • Cloud infrastructures;
  • DevOps platforms.

As a result, any security vulnerability affecting NGINX has the potential to impact large-scale internet infrastructure.

In particular, CVE-2026-42533 is considered highly attractive to threat actors because successful exploitation may enable remote code execution, making it one of the most significant security risks among the disclosed vulnerabilities.

Recommended Mitigation Measures

F5 and cybersecurity experts recommend that organizations:

  • Immediately upgrade NGINX Plus and NGINX Open Source to the latest secure versions;
  • Install all available updates for NGINX Ingress Controller, Gateway Fabric, App Protect WAF, and Instance Manager;
  • Use named regex captures instead of unnamed captures in map directives whenever possible;
  • Perform dedicated security audits on systems using the SSI module;
  • Continuously monitor internet-facing NGINX servers;
  • Watch for unusual HTTP requests and Worker Process crashes;
  • Use WAF and IDS/IPS solutions to detect and block malicious traffic;
  • Regularly audit system configurations and enable only the features that are strictly necessary.

The vulnerabilities CVE-2026-42533, CVE-2026-60005, and CVE-2026-56434 addressed by F5 pose a significant threat to internet-facing NGINX infrastructures. The possibility of remote code execution through the Heap Buffer Overflow vulnerability makes CVE-2026-42533 one of the most critical issues disclosed.

NGINX has become a fundamental component of today’s internet infrastructure. Therefore, organizations relying on NGINX should apply security updates without delay, review their configurations, and continuously monitor internet-facing services. Timely patching and rigorous security monitoring remain among the most effective defenses against large-scale cyberattacks.