F5 Patches Two Critical NGINX Open Source Flaws Enabling Remote Code Execution

Summary: F5 released security updates for two critical flaws in NGINX Open Source that could be exploited to achieve code execution, with patches available in updated versions and mitigations outlined by the company. CyStack's Trung Nguyen described CVE-2026-42530 as a "lifetime mismatch" where a session-level pointer holds memory from a closed unidirectional stream, and CVE-2026-42055 as a heap overflow in which attacker-controlled HPACK data is written to unauthorized memory regions without authentication.
Why it matters: F5 makes no mention of exploitation in the wild, but a separate critical NGINX flaw, CVE-2026-42945 (CVSS 9.2), came under active exploitation within days of public disclosure last month - and CVE-2026-42055 needs no authentication to trigger repeated worker process crashes.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-42055 CVE-2026-42530 CVE-2026-42945
Related: ⚡ Weekly Recap: Exchange 0-Day, npm Worm, Fake AI Repo, Cisco Exploit and More Cyber Risks ·
18-Year-Old NGINX Rewrite Module Flaw Enables Unauthenticated RCE Cyber Risks ·
NGINX CVE-2026-42945 Exploited in the Wild, Causing Worker Crashes and Possible RCE Cyber Risks ·