This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] F5 NGINX fixes 6 vulnerabilities

F5 fixes 6 vulnerabilities in NGINX products [1][2][3][4][5][6]. The most severe of them are listed below, the rest at [3][4][5][6]. Currently fixed versions of the individual products: NGINX Open Source [1] - 1.31.2, 1.30.3 NGINX Plus [1][2][6] - 37.0.2.1, R36 P6 NGINX Gateway Fabric [1][2][3][4][5][6] - 2.6.4

F5 NGINX - DoS, RCE (CVE-2026-42530)
CVSS 9.2 (Critical)

An unauthenticated remote attacker can, under certain conditions, perform a DoS attack on NGINX and potentially also execute code using a specially crafted HTTP/3 session. The vulnerability only affects instances with the HTTP/3 (QUIC) protocol deployed [1].

The vulnerability is present in products:

  • NGINX Open Source; >=1.31.0, <1.31.2;
  • NGINX Instance Manager; >=2.17.0, <2.22.1;
  • NGINX Gateway Fabric; >=1.3.0, <=1.6.2; >=2.0.0, <2.6.4;
  • NGINX Ingress Controller; >=3.5.0, <=3.7.2; >=4.0.0, <=4.0.1; >=5.0.0, <5.5.1;

CVSS: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

More information:

The vulnerability was publicly disclosed 17. 6. 2026.

F5 NGINX - DoS, RCE (CVE-2026-42055)
CVSS 9.2 (Critical)

An unauthenticated remote attacker can, under certain conditions, perform a DoS attack on NGINX and potentially also execute code by sending extremely large headers. The vulnerability can be exploited on specifically configured systems where the proxy_http_version 2 or grpc_pass directive is set in the location block, header checking is disabled using ignore_invalid_headers off, and at the same time the large_client_header_buffers limit is increased to more than 2 MB. If an immediate update to the fixed version is not possible, the risk can be temporarily mitigated by changing this configuration, see [2].

The vulnerability is present in products:

  • NGINX Open Source; >=1.30.0, <1.30.3; >=1.31.1, <1.31.2;
  • NGINX Instance Manager; >=2.17.0, <2.22.1;
  • NGINX Gateway Fabric; >=1.3.0, <=1.6.2; >=2.0.0, <2.6.4;
  • NGINX Ingress Controller; >=3.5.0, <=3.7.2; >=4.0.0, <=4.0.1; >=5.0.0, <5.5.1;
  • NGINX Plus; >=37.0.0, <37.0.2.1;
  • F5 WAF for NGINX; >=5.9.0, <=5.13.1;
  • NGINX App Protect WAF; >=4.10.0, <=4.16.0; >=5.2.0, <=5.8.0;
  • F5 DoS for NGINX; ==4.9.0;
  • NGINX App Protect DoS; >=4.3.0, <=4.7.0;

CVSS: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

More information:

The vulnerability was publicly disclosed 17. 6. 2026.

By CESNET, z.s.p.o. Michaela Ručková on 2. 7. 2026.

CESNET, z.s.p.o. Logo