F5 Patches Three Critical NGINX Vulnerabilities, Including Heap Overflow and Code Execution Flaws
F5 has released patches for three high-severity vulnerabilities in NGINX Plus and Open Source, with one flaw potentially allowing unauthenticated attackers to execute arbitrary code.
F5 has announced the release of patches for three significant vulnerabilities affecting its NGINX Plus and NGINX Open Source products. These flaws, disclosed on July 15, 2026, pose risks ranging from denial-of-service to arbitrary code execution, with one critical vulnerability carrying a CVSS v4.0 score of 9.2.
The most severe of the vulnerabilities, CVE-2026-42533, is a heap buffer overflow flaw. It arises from the way the map directive handles regular expression matching when a string expression references capture variables before the map's output variable. Attackers can exploit this by sending specially crafted HTTP requests, leading to a heap buffer overflow within the NGINX worker process. While this can cause service crashes, F5 warns that it could also lead to arbitrary code execution on systems where Address Space Layout Randomization (ASLR) is disabled or can be bypassed.
To mitigate CVE-2026-42533 without patching, F5 recommends switching to named regex captures instead of unnamed ones in the map directive. This change addresses the root cause of the overflow by altering how capture variables are handled.
Another vulnerability, CVE-2026-60005, affects the ngx_http_slice_module. This module is not enabled by default and requires specific build flags. When the slice directive is used in conjunction with unnamed regex captures or during background cache updates, attackers can trigger an uninitialized memory disclosure. This could lead to limited data leakage or a worker process restart. Similar to the first vulnerability, using named captures is recommended as a mitigation strategy.
The third vulnerability, CVE-2026-56434, is a use-after-free flaw impacting the ngx_http_ssi_module. This issue occurs when Server-Side Includes (SSI) are used alongside proxy_pass with proxy_buffering disabled. A man-in-the-middle attacker who can control upstream responses could exploit this to trigger a use-after-free condition, potentially leading to limited memory modification or a service crash. For this vulnerability, patching is the only available mitigation.
These vulnerabilities affect various NGINX components, including NGINX Plus (versions prior to 37.0.3.1), NGINX Open Source (versions prior to 1.31.3 or 1.30.4), and related products like the Ingress Controller, Gateway Fabric, App Protect WAF, and Instance Manager. While some branches of these related products are still awaiting patches, F5 has confirmed that core products like BIG-IP, BIG-IQ, and F5 Distributed Cloud are not vulnerable.
Given NGINX's widespread use in internet-facing infrastructure, these vulnerabilities, particularly CVE-2026-42533 due to its code execution potential, represent a significant risk. Organizations utilizing affected NGINX deployments are strongly advised to prioritize applying the available patches to protect their systems from exploitation.
This new advisory from F5 details eight vulnerabilities across NGINX and BIG-IP products, expanding on the previously reported three critical NGINX flaws. The update includes CVE-2026-42533, a critical heap buffer overflow in NGINX Plus and Open Source that can lead to code execution if ASLR is disabled. Additionally, several high-severity NGINX bugs are patched, affecting modules like ngx_http_slice_module and ngx_http_ssi_module, with potential impacts including memory leaks and process restarts. A separate high-severity flaw in BIG-IP, affecting HTTP/2 profiles, can lead to denial-of-service conditions.
This new report details a critical heap buffer overflow vulnerability, CVE-2026-42533, affecting NGINX and NGINX Plus, which can lead to denial-of-service conditions or potentially remote code execution if ASLR is bypassed. The vulnerability stems from a specific configuration involving regex-based maps and string expressions, where the script engine's two-pass evaluation process can lead to an oversized buffer being written into. While F5 has released patches for core NGINX and NGINX Plus, the advisory notes that fixed builds for affected downstream products like NGINX Ingress Controller and Gateway Fabric were not yet available at publication.
This new report details that the vulnerability, CVE-2026-42533, has been exploitable since March 2011 and affects NGINX's script engine due to a missing save/restore of PCRE capture state. Exploitation can lead to heap buffer overflows or information leaks, with a proof-of-concept demonstrating high reliability for achieving remote code execution. The researcher has also released a static configuration scanner to help administrators identify vulnerable setups.
This new report details the specific technical mechanism behind CVE-2026-42533, a critical heap buffer overflow in NGINX Plus and Open Source. It explains how crafted TLS traffic processed by the Stream module's ssl_preread feature, in conjunction with regex-based map directives or non-cacheable variables, can lead to arbitrary code execution. The article also highlights the release of a Proof-of-Concept exploit, underscoring the urgency for affected organizations to review their configurations and apply patches.