One unsuccessfully processed query can turn a web server into an entry point for an attack. F5 has uncovered three vulnerabilities in NGINX Plus and NGINX Open Source, which allow you to cause a malfunction of work processes, get fragments of data from memory, and under certain conditions to perform arbitrary code.
The problems affect not only the main NGINX assemblies, but also the components created on their basis, including NGINX Ingress Controller, Gateway Fabric, App Protect WAF and Instance Manager. To carry out two attacks, the attacker does not need an account or pre-access to the server.
The most dangerous vulnerability CVE-2020-42533 (9.2 Critical) occurs when regular expressions are processed in the map directive, if the configuration refers to the capture variables in a certain sequence. A specially prepared request can cause a buffer overflow in the dynamic memory of the NGINX workflow. Most often, the attack will end with an emergency stop of the process, but on systems with a disconnected or overwhelmed randomization of the target space, the attacker will potentially be able to start his own code. As a temporary protection, F5 advises using named grip groups instead of unnamed.
The second vulnerability, CVE-2026-60005 (8.8 High), is associated with the ngx_http_slice_module module, which is disabled by default and is added when assembling a separate parameter. The error allows you to read non-initialized areas of memory when the slice directive is used together with unnamed capture groups or when the cache is updated in the background. As a result, the attacker can get a limited amount of data from memory or cause a restart of the work process. Until the update is established, the developers also recommend switching to the named capture groups.
The third vulnerability, CVE-2026-56434 (8.3 High), affects the server inclusion module ngx_htp_ssi_module. The error is manifested when the module is used together with the proxy_pass directive and the buffering of the proxy server. An intruder capable of intercepting a connection and managing the responses of a higher server can ensure that the server will turn to the memory already released. The attack allows you to change the contents of the memory or complete the workflow. There is no temporary method of protection, so F5 recommends establishing a corrected version.
Vulnerabilities are fixed in NGINX Plus 37.0.3.1, as well as in NGINX Open Source 1.31.3 and 1.30.4. Updates for Ingress Controller, Gateway Fabric, App Protect WAF and Instance Manager come out separately for each supported branch. For some branches, corrections are still being prepared at the time of publication. BIG-IP, BIG-IQ, F5 Distributed Cloud, F5OS and F5 AI Gateway products are not susceptible to vulnerabilities. Errors are in NGINX components that directly process network traffic.
Administrators are advised to first update the servers where the map directive works with regular expressions, the SSI module is used, or the caching of responses is enabled. NGINX is widespread, so vulnerabilities are attractive to mass attacks, especially CVE-2026-42533, which potentially allows you to execute code.
The problems affect not only the main NGINX assemblies, but also the components created on their basis, including NGINX Ingress Controller, Gateway Fabric, App Protect WAF and Instance Manager. To carry out two attacks, the attacker does not need an account or pre-access to the server.
The most dangerous vulnerability CVE-2020-42533 (9.2 Critical) occurs when regular expressions are processed in the map directive, if the configuration refers to the capture variables in a certain sequence. A specially prepared request can cause a buffer overflow in the dynamic memory of the NGINX workflow. Most often, the attack will end with an emergency stop of the process, but on systems with a disconnected or overwhelmed randomization of the target space, the attacker will potentially be able to start his own code. As a temporary protection, F5 advises using named grip groups instead of unnamed.
The second vulnerability, CVE-2026-60005 (8.8 High), is associated with the ngx_http_slice_module module, which is disabled by default and is added when assembling a separate parameter. The error allows you to read non-initialized areas of memory when the slice directive is used together with unnamed capture groups or when the cache is updated in the background. As a result, the attacker can get a limited amount of data from memory or cause a restart of the work process. Until the update is established, the developers also recommend switching to the named capture groups.
The third vulnerability, CVE-2026-56434 (8.3 High), affects the server inclusion module ngx_htp_ssi_module. The error is manifested when the module is used together with the proxy_pass directive and the buffering of the proxy server. An intruder capable of intercepting a connection and managing the responses of a higher server can ensure that the server will turn to the memory already released. The attack allows you to change the contents of the memory or complete the workflow. There is no temporary method of protection, so F5 recommends establishing a corrected version.
Vulnerabilities are fixed in NGINX Plus 37.0.3.1, as well as in NGINX Open Source 1.31.3 and 1.30.4. Updates for Ingress Controller, Gateway Fabric, App Protect WAF and Instance Manager come out separately for each supported branch. For some branches, corrections are still being prepared at the time of publication. BIG-IP, BIG-IQ, F5 Distributed Cloud, F5OS and F5 AI Gateway products are not susceptible to vulnerabilities. Errors are in NGINX components that directly process network traffic.
Administrators are advised to first update the servers where the map directive works with regular expressions, the SSI module is used, or the caching of responses is enabled. NGINX is widespread, so vulnerabilities are attractive to mass attacks, especially CVE-2026-42533, which potentially allows you to execute code.
