Top Highlights
- Attackers can exploit remote unauthenticated vulnerabilities in NGINX (CVE-2026-42530 and CVE-2026-42055) to execute arbitrary code, especially on systems with disabled ASLR or misconfigured headers.
- Exploitation involves manipulating HTTP/3 sessions or large headers via specific NGINX modules, enabling remote code execution.
- Critical vulnerabilities have already been exploited in the wild, as seen with recent active attacks on similar NGINX flaws like CVE-2026-42945 (NGINX Rift).
Threats, Attack Techniques, and Targets
F5 has announced two critical vulnerabilities in NGINX Open Source that could be exploited for remote code execution. The first, CVE-2026-42530, is a use-after-free flaw in the ngx_http_v3_module. Attackers can trigger it by sending specially crafted HTTP/3 sessions, especially when the system is not protected by Address Space Layout Randomization (ASLR). The second, CVE-2026-42055, is a heap-based buffer overflow in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. Attackers can exploit this through HTTP/2 traffic, especially when certain directives are misconfigured or set to large values. Both vulnerabilities are remote and do not require user authentication. Attack techniques include sending malicious HTTP/3 or HTTP/2 requests to affected systems. The targets are systems running specific versions of NGINX Open Source and other related products configured with the vulnerable modules and settings. Since these flaws can be exploited without authentication, any publicly accessible NGINX instance using the affected configurations is at risk.
Impact, Security Implications, and Remediation Guidance
The vulnerabilities can enable attackers to execute malicious code on affected systems. This could lead to full system compromise, data theft, or service disruption. Systems with disabled ASLR are particularly vulnerable. The security implications are serious, especially for organizations relying on NGINX for web hosting, proxying, or load balancing. To reduce risk, F5 recommends disabling HTTP/3 or changing specific configuration settings for CVE-2026-42530. For CVE-2026-42055, it is advised to remove the ignore_invalid_headers directive or reduce the size of large_client_header_buffers below 2 MB. Current information does not specify if these vulnerabilities are actively exploited. Therefore, affected organizations should consult with relevant vendors or security authorities for the latest remediation guidance and update to software versions where fixes are available.
Stay Ahead with the Latest Tech Trends
Learn how the Internet of Things (IoT) is transforming everyday life.
Explore past and present digital transformations on the Internet Archive.
ThreatIntel-V1
