F5 has disclosed three security vulnerabilities affecting NGINX Plus and NGINX Open Source, including a critical flaw that could allow remote code execution on systems with weakened memory protections.
The advisories, published July 15, 2026, span core NGINX modules used widely across production web infrastructure, cloud gateways, and Kubernetes ingress deployments.
The most severe issue, tracked as CVE-2026-42533, carries a CVSS v4.0 score of 9.2 (Critical) and stems from improper handling of regex capture variables in the map directive.
F5 Fixes NGINX Flaws
When a string expression references a map’s regex capture variables before the map output variable or uses a non-cacheable variable under specific conditions, an unauthenticated attacker can send crafted HTTP requests to trigger a heap buffer overflow (CWE-122) in the NGINX worker process.
F5 warns that on systems with Address Space Layout Randomization (ASLR) disabled, or where an attacker can bypass ASLR, this flaw could escalate from a worker crash to arbitrary code execution.
The second advisory, CVE-2026-56434, affects the ngx_http_ssi_module and has a CVSS v4.0 score of 8.3 (High) on CVSS v4.0. Exploitation requires a specific configuration combining Server-Side Includes (SSI), proxy_pass, and proxy_buffering off.
An attacker with man-in-the-middle control over upstream server responses can trigger a use-after-free condition (CWE-416), potentially causing limited memory corruption or forcing a worker process restart.
The third issue, CVE-2026-60005, affects the ngx_http_slice_module and rates 8.8 (High) on the CVSS v4.0 scale. It arises from uninitialized memory access (CWE-908) when the slice directive is combined with unnamed regex captures, or during background cache updates.
Unauthenticated attackers can exploit this remotely to leak limited memory contents or crash the worker process. Notably, this module isn’t enabled by default it requires explicit compilation with the –with-http_slice_module flag.
Affected products and versions
- NGINX Plus 37.0.0.1–37.0.2.1 (fixed in 37.0.3.1)
- NGINX Open Source 1.30.0–1.30.3 and 1.31.2 (fixed in 1.30.4 and 1.31.3)
- NGINX Instance Manager 2.17.0–2.22.1 (no fix yet available)
- F5 WAF for NGINX 5.9.0–5.13.3 and NGINX App Protect WAF 4.x/5.x (no fix yet available)
- NGINX Gateway Fabric 1.x and 2.0.0–2.6.6 (2.x fixed in 2.6.7)
- NGINX Ingress Controller 3.x, 4.x, and 5.x releases through 2026-lts-r3/5.5.2 (5.x fixed in 5.5.3 or 2026-lts-r4)
F5 confirmed that BIG-IP, BIG-IQ, BIG-IP Next, F5 Distributed Cloud, F5OS, NGINX One Console, Traffix SDC, and F5 AI Gateway are not vulnerable to any of these three issues, limiting the blast radius to standalone NGINX deployments and NGINX-based Kubernetes tooling.
Mitigation
For CVE-2026-42533 and CVE-2026-60005, F5 recommends avoiding unnamed regex captures in favor of named captures, and restricting their use to the same block as the regex match.
CVE-2026-56434 has no interim mitigation; organizations running the vulnerable SSI/proxy configuration should prioritize patching.
Administrators running NGINX Instance Manager or App Protect WAF should monitor F5’s advisory pages, as fixed versions have not yet been released for those product lines.
Given the network-exploitable, unauthenticated nature of these flaws, particularly the critical map directive bug, security teams should treat patching as high priority, especially for internet-facing NGINX instances handling untrusted input.
Prevent critical incidents and financial loss with stronger proactive defense. Integrate a live threat feed from 15K SOCs
