F5 Out-of-Band Patches for Critical NGINX HTTP/3 Use-After-Free and Proxy/gRPC Heap Overflow (CVE-2026-42530, CVE-2026-42055) plus NGINX Gateway Fabric Config Injection (CVE-2026-11311, CVE-2026-50107)
F5 Out-of-Band Patches for Critical NGINX HTTP/3 (TL-2026-0848) is a critical-severity software vulnerability scored CVSS 9.2, first published 2026-06-18. It has no confirmed attribution, affects F5 / NGINX NGINX (Open Source / Plus) - HTTP/3 module (CVE-2026-42530), references 4 CVEs (CVE-2026-42530, CVE-2026-42055, CVE-2026-11311), maps to 14 MITRE ATT&CK techniques (T1005, T1046, T1059), and is covered by 9 detection rules and 19 indicators of compromise.
Key facts for TL-2026-0848
- Threat ID
- TL-2026-0848
- Severity
- CRITICAL
- CVSS
- 9.2 (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- 2026-06-18
- Last reviewed
- 2026-06-18
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- technology, telecommunications, financial, government, healthcare, ecommerce, hosting
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 19
F5 issued out-of-band patches for two critical, remotely triggerable memory-corruption flaws in NGINX: a use-after-free in the HTTP/3 (QUIC/QPACK) module (CVE-2026-42530) and a heap-based buffer overflow in the HTTP/2 proxy and gRPC modules (CVE-2026-42055), both of which can cause worker-process denial-of-service and, where ASLR is disabled or bypassed, remote code execution. Two additional high-severity configuration-injection flaws (CVE-2026-11311, CVE-2026-50107) affect NGINX Gateway Fabric. F5 did not report any of these as exploited in the wild.
How F5 Out-of-Band Patches for Critical NGINX HTTP/3 works
On 17-18 June 2026, F5 released out-of-band security updates for multiple NGINX vulnerabilities, shipping nginx 1.31.2 (mainline), nginx 1.30.3 (stable), and NGINX Gateway Fabric 2.6.4. Two of the flaws are critical (CVSS v4.0 9.2) and remotely triggerable by an unauthenticated attacker.
CVE-2026-42530 is a use-after-free (CWE-416) in the ngx_http_v3_module. When NGINX is configured for HTTP/3, an attacker can send a specially crafted HTTP/3/QUIC session that reopens a QPACK encoder stream, triggering a use-after-free in the worker process. The immediate impact is worker-process memory corruption or segmentation fault (a denial-of-service via repeated worker restarts); on systems where Address Space Layout Randomization (ASLR) is disabled or can be bypassed, the condition can be leveraged for remote code execution. It affects nginx 1.31.0-1.31.1 and is fixed in 1.31.2. It was credited to Trung Nguyen of CyStack. F5 tracks it as K000161616.
CVE-2026-42055 is a heap-based buffer overflow (CWE-122) in the ngx_http_proxy_v2_module and ngx_http_grpc_module. When NGINX is configured with 'ignore_invalid_headers off;' and a large 'large_client_header_buffers' value (notably >= 2MB) and is proxying a specially crafted request to an HTTP/2 or gRPC backend, a heap overflow can occur in the worker process. As with the HTTP/3 flaw, the impact ranges from worker-process DoS to RCE where ASLR is disabled or bypassed. It affects a very wide range, nginx 1.13.10-1.31.1, and is fixed in 1.31.2 and 1.30.3. It was credited to Mufeed VH of Winfunc Research. F5 tracks it as K000161584.
The same nginx 1.31.2 release also fixed CVE-2026-48142, a heap buffer overread (memory disclosure) in UTF-8 charset decoding via the charset_map directive, credited to Han Yan of Xiaomi and p4p3r of CYBERONE.
Two high-severity flaws affect NGINX Gateway Fabric (the Kubernetes Gateway API implementation), both fixed in release 2.6.4 (PR 5467). CVE-2026-50107 (CVSS 8.1, CWE-74) is a configuration-injection flaw: an authenticated user with permission to create or modify NginxProxy Custom Resource Definitions (CRDs) can inject arbitrary NGINX configuration directives via unsanitized access-log-format string values, compromising the control plane. CVE-2026-11311 is a related configuration-injection issue addressed by extending validation for OIDC extra-args in AuthenticationFilter and for Server Tokens in NginxProxy. F5 tracks the Gateway Fabric issues as K000161611 and K000161785. The Gateway Fabric flaws affect only the control plane and require authenticated access to Kubernetes CRDs; they do not directly expose the data plane.
NGINX is one of the most widely deployed web servers, reverse proxies, and load balancers on the internet, and NGINX Plus, NGINX Open Source, NGINX Gateway Fabric, and NGINX Instance Manager are all in scope. While F5 reported no active exploitation at disclosure, NGINX and F5 products have historically been high-value targets for both cybercriminals and nation-state actors, and the out-of-band timing signals elevated urgency. Defenders should patch immediately and, where patching is delayed, apply the documented configuration mitigations.
MITRE ATT&CK techniques used in TL-2026-0848
Collection
Discovery
T1046 Network Service Discovery
Execution
T1059 Command and Scripting Interpreter
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Defense Evasion
T1211 Exploitation for Stealth
Impact
T1499 Endpoint Denial of Service
Persistence
T1505 Server Software Component
Resource Development
T1587 Develop Capabilities; T1588 Obtain Capabilities
Reconnaissance
T1592 Gather Victim Host Information; T1595 Active Scanning
defense-impairment
Affected products and versions in F5 Out-of-Band Patches for Critical NGINX HTTP/3
- F5 / NGINX — NGINX (Open Source / Plus) - HTTP/3 module (CVE-2026-42530)
Vulnerable versions: 1.31.0; 1.31.1
Fixed in: 1.31.2 - F5 / NGINX — NGINX (Open Source / Plus) - proxy_v2 / grpc modules (CVE-2026-42055)
Vulnerable versions: 1.13.10 through 1.31.1
Fixed in: 1.31.2; 1.30.3 - F5 / NGINX — NGINX (Open Source / Plus) - charset module (CVE-2026-48142)
Vulnerable versions: through 1.31.1
Fixed in: 1.31.2 - F5 / NGINX — NGINX Gateway Fabric (CVE-2026-50107, CVE-2026-11311)
Vulnerable versions: 2.3.0 and earlier through 2.6.3
Fixed in: 2.6.4
Remediation for F5 Out-of-Band Patches for Critical NGINX HTTP/3
Patches
- nginx 1.31.2 (mainline)
- nginx 1.30.3 (stable)
- NGINX Gateway Fabric 2.6.4
- F5 articles K000161616, K000161584, K000161611, K000161785
Immediate actions
- Upgrade NGINX mainline to 1.31.2 (fixes CVE-2026-42530, CVE-2026-42055, CVE-2026-48142)
- Upgrade NGINX stable to 1.30.3 (fixes CVE-2026-42055)
- Upgrade NGINX Gateway Fabric to 2.6.4 (fixes CVE-2026-11311 and CVE-2026-50107)
- Inventory all NGINX Plus, NGINX Open Source, NGINX Gateway Fabric, and NGINX Instance Manager instances and confirm versions
Workarounds
- CVE-2026-42530: disable HTTP/3 by removing the 'quic' parameter from all 'listen' directives until patched
- CVE-2026-42055: remove the 'ignore_invalid_headers off;' directive and reduce 'large_client_header_buffers' below 2MB
- CVE-2026-50107 / CVE-2026-11311: restrict Kubernetes RBAC so only trusted principals can create or modify NginxProxy and AuthenticationFilter CRDs
Longer-term hardening
- Ensure ASLR is enabled on all hosts running NGINX to raise the bar from RCE to DoS
- Deploy WAF/IPS signatures for malformed HTTP/3 QPACK and oversized HTTP/2/gRPC header traffic
- Monitor NGINX worker-process crash and restart telemetry as an exploitation signal
- Enforce least-privilege RBAC and admission control (e.g., OPA/Kyverno) over NGINX Gateway Fabric CRDs
CVEs associated with F5 Out-of-Band Patches for Critical NGINX HTTP/3
CVE-2026-42530, CVE-2026-42055, CVE-2026-11311, CVE-2026-50107
Weaknesses (CWE) in F5 Out-of-Band Patches for Critical NGINX HTTP/3
CWE-416, CWE-122, CWE-74
Timeline of F5 Out-of-Band Patches for Critical NGINX HTTP/3
- Vulnerable code path for CVE-2026-42055 introduced no later than nginx 1.13.10 (the earliest version in the documented affected range 1.13.10 through 1.31.1).
- F5 published knowledge-base advisories K000161616 (CVE-2026-42530), K000161584 (CVE-2026-42055), K000161611 (CVE-2026-11311) and K000161785 (CVE-2026-50107).
- CVE-2026-42530 (CVSS v4.0 9.2, CWE-416) and CVE-2026-42055 (CVSS v4.0 9.2, CWE-122) published to NVD at 15:16 UTC; status Awaiting Analysis.
- NGINX Gateway Fabric 2.6.4 released, fixing configuration-injection flaws CVE-2026-11311 (OIDC extra args / server tokens) and CVE-2026-50107 (access-log-format) via PR 5467.
- F5/NGINX released nginx 1.31.2 (mainline) fixing CVE-2026-42530, CVE-2026-42055 and CVE-2026-48142, and nginx 1.30.3 (stable) fixing CVE-2026-42055.
- CVE-2026-42530 reported to NGINX by Trung Nguyen of CyStack; CVE-2026-42055 reported by Mufeed VH of Winfunc Research; CVE-2026-48142 reported by Han Yan of Xiaomi and p4p3r of CYBERONE (credits per nginx 1.31.2 CHANGES).
- F5 reported no known exploitation in the wild at time of disclosure; out-of-band timing indicates elevated urgency for the critical memory-corruption flaws.
- BleepingComputer reported the coordinated F5/NGINX out-of-band vulnerability release covering the HTTP/3, proxy/gRPC, charset and NGINX Gateway Fabric flaws.
Sources cited for F5 Out-of-Band Patches for Critical NGINX HTTP/3
- F5 issues out-of-band patches for critical NGINX vulnerabilities
- nginx security advisories
- nginx CHANGES (1.31.2, 17 Jun 2026)
- F5 advisory K000161616 - ngx_http_v3_module vulnerability CVE-2026-42530
- F5 advisory K000161584 - ngx_http_proxy_v2_module/ngx_http_grpc_module vulnerability CVE-2026-42055
- F5 advisory K000161611 - NGINX Gateway Fabric vulnerability CVE-2026-11311
- F5 advisory K000161785 - NGINX Gateway Fabric vulnerability CVE-2026-50107
- NVD - CVE-2026-42530
- NVD - CVE-2026-42055
- CVE.org record - CVE-2026-42530
- CVE.org record - CVE-2026-42055
- nginx-gateway-fabric CHANGELOG (Release 2.6.4)
- nginx-gateway-fabric PR 5467 (config validation hardening for 2.6.4)
- OffSeq Threat Radar - CVE-2026-50107 (NGINX Gateway Fabric config injection)
- MITRE ATT&CK - T1190 Exploit Public-Facing Application
Threats related to F5 Out-of-Band Patches for Critical NGINX HTTP/3
- F5 Patches Multiple NGINX Vulnerabilities: Heap Overflow, Memory Disclosure, and Use-After-Free (CVE-2026-42533, CVE-2026-60005, CVE-2026-56434)
- HTTP/2 Bomb — Remote DoS via HPACK Indexed-Reference Compression Bomb + Zero-Window Flow-Control Hold Affecting nginx, Apache httpd, IIS, Envoy & Cloudflare Pingora (CVE-2026-49975, Public PoC)
- HollowByte: OpenSSL Pre-Authentication TLS DoS Flaw Bloats Server Memory With 11-Byte Payload
- NGINX Rift — CVE-2026-42945 Heap Buffer Overflow in ngx_http_rewrite_module (CVSS v4 9.2 Critical, 18-Year-Old Pre-Auth RCE, Public PoC)
- LangGraph Checkpointer: Chained SQLi-to-RCE via Unsafe msgpack Deserialization (CVE-2025-67644, CVE-2026-28277, CVE-2026-27022)
- Microsoft June 2026 Patch Tuesday — 198+ CVEs Including CVE-2026-49160 (HTTP.sys 'HTTP/2 Bomb' DoS), CVE-2026-50507 (BitLocker 'YellowKey' Bypass) and CVE-2026-45586 (Collaborative Translation Framework EoP)
Detection coverage for TL-2026-0848
As of 2026-06-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0848 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.