FHN 
F5 has issued an emergency security advisory addressing several vulnerabilities affecting NGINX products and related components. The flaws could allow attackers to disrupt services, crash applications, or potentially execute malicious code in vulnerable environments.
The notification covers multiple products, including NGINX Open Source, NGINX Plus, NGINX Instance Manager, NGINX Gateway Fabric, NGINX Ingress Controller, and App Protect security modules. According to F5, organizations using affected versions should prioritize updates to reduce exposure to active threats.
Critical Vulnerabilities Impact HTTP/3, HTTP/2, and gRPC Services
Among the most serious issues is CVE-2026-42530, a vulnerability within the NGINX HTTP/3 module. Attackers can exploit specially crafted HTTP/3 requests to trigger memory-related errors, causing worker processes to crash repeatedly. In certain environments, the flaw may also open a path for remote code execution.
Another high-risk vulnerability, CVE-2026-42055, affects deployments that utilize HTTP/2 or gRPC proxying. Malicious traffic can abuse weaknesses in request handling, potentially leading to service interruptions, application crashes, and in some cases, code execution risks.
Key concerns include:
- Potential remote code execution on vulnerable systems
- Denial-of-service conditions causing service outages
- Increased risk for environments using HTTP/3, HTTP/2, and gRPC
- Exposure across several NGINX-based products and services
Gateway Fabric Vulnerabilities Add Additional Risk
F5 also highlighted multiple high-severity vulnerabilities impacting NGINX Gateway Fabric deployments. These issues can affect traffic routing reliability, application availability, and overall service stability in cloud-native and gateway environments.
To address the risks, F5 has released updated versions containing security fixes and recommends that customers:
- Upgrade affected NGINX products immediately
- Review exposed HTTP/2, HTTP/3, and gRPC services
- Verify that security patches have been applied successfully
- Update Gateway Fabric deployments to the latest supported release
The advisory serves as a reminder that organizations relying on modern web application infrastructure should maintain a proactive patch management strategy, particularly when vulnerabilities affect core traffic-processing components.
Recommended Security Actions
F5 urges customers to update affected NGINX products to the latest secure versions as soon as possible.
For systems that cannot be patched immediately, organizations should disable unnecessary HTTP/3 and QUIC services, limit HTTP/2 and gRPC exposure, strengthen access controls, and enable security hardening measures to reduce the risk of exploitation.
About the Author
