This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] F5 fixes over 50 vulnerabilities in its products

F5 Networks fixes over 50 vulnerabilities in various products [1][2][3]. Selected vulnerabilities are described below, the remaining ones can be found at [1]. Latest fixed versions of individual products: BIG-IP (all modules) [1] - 21.0.0.2, 17.5.1.6, 17.1.3.2 BIG-IQ Centralized Management [1] - 8.4.2 BIG-IP Next SPK [1] - 2.0.3, 1.7.17 BIG-IP Next CNF [1] - 2.0.3, 1.4.1 BIG-IP Next for Kubernetes [1] - 2.2.0 NGINX Plus [2] - 37.0.1.1, R36 P5, R32 P7 NGINX Open Source [2] - 1.31.1, 1.30.2 NGINX Gateway Fabric [2] - 2.6.2 NGINX Ingress Controller [2] - 5.4.3 F5 WAF for NGINX [1] - 5.13.0 F5 DoS for NGINX [1] - 4.9.0 NGINX JavaScript (njs) [3] - 0.9.9

NGINX (CVE-2026-9256) - DoS, RCE
CVSS 9.2 (Critical)

An unauthenticated remote attacker can, due to faulty handling of regular expressions in the ngx_http_rewrite_module module of NGINX Plus and Open Source, under certain conditions carry out a DoS attack on the NGINX system by sending specially crafted HTTP requests. If Address Space Layout Randomization (ASLR) is disabled on the system or the attacker is able to bypass ASLR, they can potentially execute code [2].

The vulnerability is present in products:

  • NGINX Plus; >=37.0.0, <37.0.1.1;
  • NGINX Plus; >=R32, <R32 P7; >=R36, <R36 P5;
  • NGINX Open Source; >=0.1.17, <=0.9.7; >=1.0.0, <1.30.2; >=1.31.0, <1.31.1;
  • NGINX Instance Manager; >=2.16.0, <=2.22.0;
  • F5 WAF for NGINX; >=5.9.0, <=5.13.0;
  • NGINX App Protect WAF; >=4.10.0, <=4.16.0; >=5.2.0, <=5.8.0;
  • NGINX Gateway Fabric; >=1.3.0, <=1.6.2; >=2.0.0, <=2.6.1;
  • NGINX Ingress Controller; >=3.5.0, <=3.7.2; >=4.0.0, <=4.0.1; >=5.0.0, <=5.4.2;
  • F5 DoS for NGINX; ==4.9.0;
  • NGINX App Protect DoS; >=4.3.0, <=4.7.0;

CVSS: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

More information:

The vulnerability was publicly disclosed 22. 5. 2026.

NGINX JavaScript (CVE-2026-8711) - DoS, RCE
CVSS 9.2 (Critical)

An unauthenticated remote attacker can, under certain conditions, carry out a DoS attack on the NGINX system by sending specially crafted HTTP requests in the ngx_http_js_module module (NGINX JavaScript). The vulnerability is exploitable if js_fetch_proxy uses at least one variable fully controlled by the client (e.g. HTTP headers or arguments) and the JavaScript operation ngx.fetch() is executed within the same block (/location). If Address Space Layout Randomization (ASLR) is disabled on the system or the attacker is able to bypass ASLR, they can potentially execute code [3].

The vulnerability is present in product:

  • NGINX JavaScript; >=0.9.4, <=0.9.8;

CVSS: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

More information:

The vulnerability was publicly disclosed 19. 5. 2026.

BIG-IP & BIG-IQ Centralized Management (CVE-2026-41957) - command execution, unauthorized operations
CVSS 8.7 (High)

An authenticated remote attacker with access to the Configuration utility interface can, under certain conditions, execute arbitrary system commands, delete/create files or disable services without authorization in BIG-IP and BIG-IQ products. It is generally recommended to restrict access to the Configuration utility administration to trusted devices and networks only [4].

The vulnerability is present in products:

  • BIG-IP; >=16.1.0, <=16.1.6; >=17.1.0, <17.1.3.1; >=17.5.0, <17.5.1.4;
  • BIG-IQ Centralized Management; >=8.4.0, <8.4.1;

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

More information:

The vulnerability was publicly disclosed 13. 5. 2026.

By CESNET, z.s.p.o. Michaela Ručková on 1. 6. 2026.

CESNET, z.s.p.o. Logo