Critical alert: two high-severity NGINX Open Source errors allow remote code execution without authentication (CVSS 9.2) and require immediate parking

F5 has published critical patches for two security failures in NGINX Open Source which, under certain conditions, allow remote code execution without authentication. These are high-gravity vulnerabilities (CVSS 9.2) that affect modules used for HTTP / 3 / QUIC and HTTP / 2 / gRPC proxy and should be considered urgent by the operations and security teams that manage NGINX-based liaison doors, swimmers or Ingress drivers.

The first vulnerability (CVE-2026-42530) is an after-free use in the ngx _ http _ v3 _ module that can be activated by HTTP / 3 sessions specially built to force the reopening of a QPACK flow. The second (CVE-2026-42055) is a heap buffer overflow that affects ngx _ http _ proxy _ v2 _ module and ngx _ http _ grpc _ module when HTTP / 2 traffic is propagated under certain directives and very large header buffer sizes. In both cases the operating scenarios allow remote code execution in systems where the ASLR protection is disabled or can be drawn by the attacker, which amplifies the risk in preconfigured applications or images that do not follow modern hardening.

F5 published corrections to be applied as soon as possible: NGINX Open Source received fixes in the 1.30.x and 1.31.x branches (1.31.2 and 1.30.3 contain patches), while NGINX Plus and F5-managed editions have versions with equivalent remediations. Related components such as NGINX Gateway Fabric, Instance Manager, App Protect and Ingress drivers have also been updated in the affected ranges. Check the official NGINX security notes and F5 communications to confirm the specific version it applies to your deployment: NGINX security advisory and F5 Product Security.

No public mention of active exploitation should not lead to complacency. Recent history shows that critical failures in the NGINX and F5 ecosystem have been taken advantage of in a short time after public disclosure, so organizations must assume a realistic risk window between publication and mass parking. If your NGINX instance is accessible from the Internet or is in charge of API / gRPC traffic, treat it as a top priority.

As for practical measures, it begins by identifying all the points where NGINX is run: physical applications, virtual machines, containers (especially Ingress drivers in Kubernetes) and managed services. Check the versions with the usual mechanisms (e.g. nginx -v in systems where possible) and organize a patch deployment plan that includes staging environment testing to avoid regressions. If the patch cannot be applied immediately, there are temporary mitigation: disable HTTP / 3 to mitigate the failure in the QPACK module and remove the ignore _ invalid _ headers off configuration or reduce the size of the large _ client _ header _ buffers below 2 MB to reduce the overflow exposure in the proxy / gRPC. These mitigations should be implemented carefully and tested, because they may affect compatibility or performance.

Beyond the patching and configuration mitigation, it monitors operating signals such as unexpected rebeginnings, nginx processes that die after abnormal traffic, and header patterns or unusual QUIC / HTTP / 3 sessions. It updates the rules of the WAF and the IDS / IPS signatures to capture abuse attempts, and maintain network policies that minimize public exposure of managed bodies if not necessary. If you manage Kubernetes clusters, prioritize the update of Ingress Controllers and review base images to ensure that ASLR and other kernel protections are enabled on the nodes.

If you detect signs of commitment, isolate the affected instance, capture memory and overturn of processes for forensic analysis, break related credentials and consider restoring from clean previous images after the investigation. In addition, it internally communicates the risk to application owners and plans a lesson learned to avoid unpatched dependencies in the future. For general context on vulnerability management and CVE catalogues you can consult reference resources such as MITRE: CVE - MITRE.

In short, it acts quickly: it identifies assets, validates versions, patches as soon as possible or applies proven mitigation, and strengthens detection and response. The combination of remote execution failures and the previous rapid exploitation in the ecosystem make these vulnerabilities a real operational risk that requires coordinated attention between network, platform and security teams.