F5 this week released advisories and fixes for three vulnerabilities affecting both NGINX Plus and NGINX Open Source that target the data-plane request processing path.
The flaws, tracked as CVE-2026-56434, CVE-2026-42533, and CVE-2026-60005, can allow unauthenticated remote actors to trigger worker process crashes, disclose limited process memory, or under narrow conditions enable code execution.
Organizations running NGINX with the affected modules or configuration patterns should urgently review deployments and apply the updates F5 published (see advisories K000162098, K000162097, and K000162100).
F5 Patches 3 NGINX Flaws
The most critical of the trio, CVE-2026-42533, is a heap buffer overflow tied to the map directive when used with regular-expression captures.
The flaw manifests when a string expression references regex capture variables associated with a map before the map output variable itself.
F5 warned a similar issue may surface when a non-cacheable variable is used inside a string expression under some configurations.
Exploitation requires sending specially crafted HTTP requests to an NGINX worker; a successful exploit can crash the worker, causing denial-of-service, and could allow code execution in environments where Address Space Layout Randomization (ASLR) is disabled or can be bypassed.
The advisory highlights the need to audit complex map configurations that rely on dynamic regex captures and string expressions.
CVE-2026-56434 is a use-after-free vulnerability in the ngx_http_ssi_module (Server-Side Includes). It becomes exploitable in setups where SSI is enabled alongside proxy_pass and when proxy_buffering is turned off.
The attack scenario requires the adversary to control or influence upstream server responses, for example via a man-in-the-middle position or a compromised upstream, enabling crafted content to trigger the use-after-free in an NGINX worker.
F5 classifies this flaw under CWE-416; exploitation may permit limited memory modification or force worker restarts. While the requirement for upstream-response control reduces opportunistic internet-wide exploitation risk, operators should treat exposed reverse-proxy configurations and integrations with untrusted upstreams as higher risk.
The third issue, CVE-2026-60005, involves the optional ngx_http_slice_module and an uninitialized-memory access condition.
This bug can be triggered when the slice directive is used with unnamed regex captures or during background cache updates. Malicious requests may cause the worker to expose limited memory contents or restart.
F5 notes this is a CWE-908 class issue (use of an uninitialized resource). Because the slice module is not enabled by default and must be compiled with the —with-http_slice_module flag, the affected surface is narrower, but patched builds are still required for deployments that use slicing.
Affected products include both NGINX Plus and open-source NGINX instances that utilize the SSI, map-driven regex logic, or slice module in the patterns described.
F5’s advisories list version-specific fixes; administrators should consult the vendor notices, upgrade affected instances to fixed releases, and audit configurations:
Review map directives using regex captures, avoid fragile string expressions referencing capture variables out of order, ensure proxy buffering behavior is appropriate for SSI use, and confirm slice-module usage and configuration.
These vulnerabilities underscore the broader security trade-offs in feature-rich, high-performance proxies: modular capabilities and dynamic configuration give flexibility but increase the risk of subtle data-plane bugs.
Immediate remediation, configuration review, and prioritization of publicly facing proxies and reverse-proxy chains that use untrusted upstreams will reduce exposure while organizations apply F5’s fixes.
No Comment! Be the first one.