F5 Critical NGINX RCE CVE-2026-42530 and CVE-2026-42055 Patched

Cybersecurity company F5 has released out-of-band security updates for multiple critical NGINX vulnerabilities. Consequently, organizations running NGINX Plus, NGINX Open Source, or NGINX Gateway Fabric should prioritize patching immediately.

What Happened: F5 Patches Critical NGINX RCE Vulnerabilities

F5 disclosed two critical-severity flaws in NGINX web server components on June 18, 2026. Also, the company patched two additional high-severity vulnerabilities in NGINX Gateway Fabric. The most severe issues could allow unauthenticated remote attackers to execute code on vulnerable systems.

The two critical vulnerabilities are tracked as CVE-2026-42530 and CVE-2026-42055. Furthermore, both flaws affect non-default configurations and can trigger denial-of-service conditions or code execution.

F5 is a Fortune 500 technology company serving over 23,000 customers worldwide. Moreover, its customer base includes 48 of the Fortune 50 companies and 80 percent of the Fortune Global 500. Therefore, the attack surface for these vulnerabilities is extraordinarily broad.

Technical Details of the NGINX Vulnerabilities

CVE-2026-42530 affects the ngx_http_v3_module and stems from a use-after-free condition. Successful exploitation can crash the NGINX worker process or execute code when Address Space Layout Randomization (ASLR) is disabled or bypassed.

CVE-2026-42055 impacts the ngx_http_proxy_v2_module and ngx_http_grpc_module. Moreover, this flaw is a heap-based buffer overflow that can similarly lead to worker process restarts or remote code execution under the same ASLR conditions.

In addition to the critical issues, F5 patched two high-severity flaws in NGINX Gateway Fabric:

• CVE-2026-11311 — authenticated configuration directive injection
• CVE-2026-50107 — authenticated configuration directive injection

While F5 has not confirmed active exploitation of these specific CVEs, CISA has previously flagged seven F5 vulnerabilities as actively exploited. Also, four of those prior flaws were leveraged in ransomware attacks.

Business and Operational Impact

The NGINX vulnerabilities pose severe risks to enterprise infrastructure. For example, NGINX powers load balancing, reverse proxying, and API gateways for many of the world’s largest organizations.

An unauthenticated remote code execution on edge-facing web infrastructure could enable attackers to intercept traffic, pivot into internal networks, or deploy malware. Therefore, the operational consequences extend far beyond a simple service outage.

• Massive attack surface: NGINX is deployed across tens of thousands of F5 customer environments globally
• Supply chain risk: Compromised NGINX instances could affect downstream applications and APIs
• Data exposure: Reverse proxies handling sensitive traffic are high-value targets
• Ransomware precedent: F5 products have been exploited by ransomware groups in the past
• Source code theft: F5 confirmed a 2025 breach where attackers stole BIG-IP vulnerability details and source code

Mitigation and Recommendations

Organizations must assess their NGINX exposure immediately. Therefore, defenders should apply patches or implement mitigations without delay.

Immediate Actions for Defenders

1. Upgrade NGINX Plus, NGINX Open Source, NGINX Gateway Fabric, and NGINX Instance Manager to patched versions
2. If patching is not immediately possible, disable HTTP/3 by removing quic from all listen directives to mitigate CVE-2026-42530
3. Remove the ignore_invalid_headers off directive and reduce large_client_header_buffers below 2 megabytes to mitigate CVE-2026-42055
4. Audit NGINX configurations for non-standard settings that increase exposure
5. Monitor worker process crash logs and unexpected restarts as potential exploitation indicators

Long-Term Hardening Steps

Organizations should also restrict NGINX management interfaces from direct internet exposure. Furthermore, network segmentation should limit proxy access to essential systems only. Regular vulnerability scanning and configuration hardening should become standard practice.

Bottom line: F5 patched critical NGINX RCE flaws that could expose Fortune Global 500 infrastructure. Patch immediately, audit configurations, and monitor for exploitation indicators.

Incident Summary

CVE IDs:	CVE-2026-42530, CVE-2026-42055, CVE-2026-11311, CVE-2026-50107
Affected Products:	NGINX Plus, NGINX Open Source, NGINX Gateway Fabric, NGINX Instance Manager
Severity:	Critical (CVE-2026-42530, CVE-2026-42055); High (CVE-2026-11311, CVE-2026-50107)
Disclosure Date:	June 18, 2026
Patch Status:	Out-of-band patches available
Exploitation:	No confirmed active exploitation reported; prior F5 flaws actively exploited
Attack Vector:	Unauthenticated remote (critical flaws); authenticated (Gateway Fabric flaws)
Impact Scope:	23,000+ F5 customers; 48 of Fortune 50; 80% of Fortune Global 500

References

1. Sergiu Gatlan, “F5 issues out-of-band patches for critical NGINX vulnerabilities,” BleepingComputer, June 18, 2026, https://www.bleepingcomputer.com/news/security/f5-issues-out-of-band-patches-for-critical-nginx-vulnerabilities/
2. F5 Networks, “K000161616: CVE-2026-42530,” F5 Support, June 2026, https://my.f5.com/manage/s/article/K000161616
3. F5 Networks, “K000161584: CVE-2026-42055,” F5 Support, June 2026, https://my.f5.com/manage/s/article/K000161584
4. CISA, “Known Exploited Vulnerabilities Catalog,” U.S. Cybersecurity and Infrastructure Security Agency, accessed June 18, 2026, https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. Lawrence Abrams, “Hackers breach F5 to steal undisclosed BIG-IP flaws source code,” BleepingComputer, October 2025, https://www.bleepingcomputer.com/news/security/hackers-breach-f5-to-steal-undisclosed-big-ip-flaws-source-code/