F5 has shipped emergency patches for a critical security flaw in NGINX that could allow a remote, unauthenticated attacker to crash worker processes — and potentially achieve remote code execution — using specially crafted HTTP requests.
The Vulnerability: CVE-2026-42533
The flaw, tracked as CVE-2026-42533, is a heap buffer overflow in the NGINX HTTP request processing engine. When exploited, a malicious actor can send a carefully constructed HTTP request that overflows a heap-allocated buffer in the worker process, causing it to crash (denial of service) or, under certain conditions, execute attacker-controlled code.
The vulnerability is rated Critical and requires no authentication, making it particularly dangerous for internet-facing NGINX deployments.
Key details:
- Type: Heap buffer overflow
- Attack vector: Network (remote, unauthenticated)
- Impact: Worker process crash (DoS), potential RCE
- Disclosure date: July 15, 2026
Affected Versions
The following NGINX versions are vulnerable:
| Product | Vulnerable | Fixed |
|---|---|---|
| nginx (stable) | < 1.30.4 | 1.30.4 |
| nginx (mainline) | < 1.31.3 | 1.31.3 |
| NGINX Plus | < R37.0.3.1 | R37.0.3.1 |
NGINX is one of the world's most widely deployed web servers and reverse proxies, powering an estimated 30%+ of active websites globally. The broad attack surface makes rapid patching critical.
What You Should Do
Immediate actions:
- Identify all NGINX instances in your environment — check containers, VMs, bare metal, and cloud-managed deployments.
- Upgrade to the patched version for your track:
- Stable users: upgrade to
nginx 1.30.4 - Mainline users: upgrade to
nginx 1.31.3 - NGINX Plus subscribers: upgrade to
R37.0.3.1
- Stable users: upgrade to
- Verify the upgrade with
nginx -vafter patching. - Reload/restart NGINX after upgrading — the patched binary must be running for the fix to take effect.
# Check current NGINX version
nginx -v
# Ubuntu/Debian — upgrade via apt
sudo apt update && sudo apt install --only-upgrade nginx
# RHEL/CentOS — upgrade via yum/dnf
sudo dnf update nginx
# Verify after upgrade
nginx -v && sudo nginx -tTemporary Mitigations
If immediate patching is not possible:
- Rate-limit inbound HTTP connections at the network perimeter or load balancer layer to reduce exposure.
- Deploy a WAF rule to inspect and drop requests matching known exploit payloads (vendor-specific signatures may become available shortly after CVE publication).
- Monitor worker process restarts — unexpected crashes of
nginx worker processare an indicator of exploitation attempts. - Restrict access to NGINX from untrusted networks where feasible.
Why This Matters
Heap buffer overflows in web server worker processes are particularly severe because:
- Workers run continuously handling all request traffic — a crash causes immediate service disruption.
- Worker processes often retain sensitive data in memory (session tokens, upstream credentials, TLS private keys in some configurations) that could be exposed via a read-primitive exploit.
- NGINX is ubiquitous in Kubernetes ingress controllers (nginx-ingress), API gateways, and CDN edge layers — a single vulnerable Helm chart or container image can expose entire clusters.
Security teams should treat this as a P1/Critical vulnerability requiring same-week remediation for any internet-facing NGINX deployment.
Staying Current
F5 maintains the official NGINX Security Advisories page, which is the authoritative source for future updates on this CVE and others. Subscribe to security mailing lists or use a vulnerability management platform to track patch status across your NGINX fleet.