# F5 Out-of-Band Patches for Critical NGINX HTTP/3 Use-After-Free and Proxy/gRPC Heap Overflow (CVE-2026-42530, CVE-2026-42055) plus NGINX Gateway Fabric Config Injection (CVE-2026-11311, CVE-2026-50107)

> F5 issued out-of-band patches for two critical, remotely triggerable memory-corruption flaws in NGINX: a use-after-free in the HTTP/3 (QUIC/QPACK) module (CVE-2026-42530) and a heap-based buffer overflow in the HTTP/2 proxy and gRPC modules (CVE-2026-42055), both of which can cause worker-process denial-of-service and, where ASLR is disabled or bypassed, remote code execution. Two additional high-severity configuration-injection flaws (CVE-2026-11311, CVE-2026-50107) affect NGINX Gateway Fabric. F5 did not report any of these as exploited in the wild.

- **Published:** 2026-06-18T00:00:00Z
- **Last reviewed:** 2026-06-18T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0848
- **ID:** TL-2026-0848
- **Severity:** CRITICAL (CVSS 9.2)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-42530, CVE-2026-42055, CVE-2026-11311, CVE-2026-50107, CVE-2026-48142

## Description

On 17-18 June 2026, F5 released out-of-band security updates for multiple NGINX vulnerabilities, shipping nginx 1.31.2 (mainline), nginx 1.30.3 (stable), and NGINX Gateway Fabric 2.6.4. Two of the flaws are critical (CVSS v4.0 9.2) and remotely triggerable by an unauthenticated attacker.

CVE-2026-42530 is a use-after-free (CWE-416) in the ngx_http_v3_module. When NGINX is configured for HTTP/3, an attacker can send a specially crafted HTTP/3/QUIC session that reopens a QPACK encoder stream, triggering a use-after-free in the worker process. The immediate impact is worker-process memory corruption or segmentation fault (a denial-of-service via repeated worker restarts); on systems where Address Space Layout Randomization (ASLR) is disabled or can be bypassed, the condition can be leveraged for remote code execution. It affects nginx 1.31.0-1.31.1 and is fixed in 1.31.2. It was credited to Trung Nguyen of CyStack. F5 tracks it as K000161616.

CVE-2026-42055 is a heap-based buffer overflow (CWE-122) in the ngx_http_proxy_v2_module and ngx_http_grpc_module. When NGINX is configured with 'ignore_invalid_headers off;' and a large 'large_client_header_buffers' value (notably >= 2MB) and is proxying a specially crafted request to an HTTP/2 or gRPC backend, a heap overflow can occur in the worker process. As with the HTTP/3 flaw, the impact ranges from worker-process DoS to RCE where ASLR is disabled or bypassed. It affects a very wide range, nginx 1.13.10-1.31.1, and is fixed in 1.31.2 and 1.30.3. It was credited to Mufeed VH of Winfunc Research. F5 tracks it as K000161584.

The same nginx 1.31.2 release also fixed CVE-2026-48142, a heap buffer overread (memory disclosure) in UTF-8 charset decoding via the charset_map directive, credited to Han Yan of Xiaomi and p4p3r of CYBERONE.

Two high-severity flaws affect NGINX Gateway Fabric (the Kubernetes Gateway API implementation), both fixed in release 2.6.4 (PR 5467). CVE-2026-50107 (CVSS 8.1, CWE-74) is a configuration-injection flaw: an authenticated user with permission to create or modify NginxProxy Custom Resource Definitions (CRDs) can inject arbitrary NGINX configuration directives via unsanitized access-log-format string values, compromising the control plane. CVE-2026-11311 is a related configuration-injection issue addressed by extending validation for OIDC extra-args in AuthenticationFilter and for Server Tokens in NginxProxy. F5 tracks the Gateway Fabric issues as K000161611 and K000161785. The Gateway Fabric flaws affect only the control plane and require authenticated access to Kubernetes CRDs; they do not directly expose the data plane.

NGINX is one of the most widely deployed web servers, reverse proxies, and load balancers on the internet, and NGINX Plus, NGINX Open Source, NGINX Gateway Fabric, and NGINX Instance Manager are all in scope. While F5 reported no active exploitation at disclosure, NGINX and F5 products have historically been high-value targets for both cybercriminals and nation-state actors, and the out-of-band timing signals elevated urgency. Defenders should patch immediately and, where patching is delayed, apply the documented configuration mitigations.

## MITRE ATT&CK

- T1595 Active Scanning
- T1592 Gather Victim Host Information
- T1588 Obtain Capabilities
- T1587 Develop Capabilities
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Stealth
- T1685 Disable or Modify Tools
- T1046 Network Service Discovery
- T1005 Data from Local System
- T1499 Endpoint Denial of Service

## Sources

- [F5 issues out-of-band patches for critical NGINX vulnerabilities](https://www.bleepingcomputer.com/news/security/f5-issues-out-of-band-patches-for-critical-nginx-vulnerabilities/)
- [nginx security advisories](https://nginx.org/en/security_advisories.html)
- [nginx CHANGES (1.31.2, 17 Jun 2026)](https://nginx.org/en/CHANGES)
- [F5 advisory K000161616 - ngx_http_v3_module vulnerability CVE-2026-42530](https://my.f5.com/manage/s/article/K000161616)
- [F5 advisory K000161584 - ngx_http_proxy_v2_module/ngx_http_grpc_module vulnerability CVE-2026-42055](https://my.f5.com/manage/s/article/K000161584)
- [F5 advisory K000161611 - NGINX Gateway Fabric vulnerability CVE-2026-11311](https://my.f5.com/manage/s/article/K000161611)
- [F5 advisory K000161785 - NGINX Gateway Fabric vulnerability CVE-2026-50107](https://my.f5.com/manage/s/article/K000161785)
- [NVD - CVE-2026-42530](https://nvd.nist.gov/vuln/detail/CVE-2026-42530)
- [NVD - CVE-2026-42055](https://nvd.nist.gov/vuln/detail/CVE-2026-42055)
- [CVE.org record - CVE-2026-42530](https://www.cve.org/CVERecord?id=CVE-2026-42530)
- [CVE.org record - CVE-2026-42055](https://www.cve.org/CVERecord?id=CVE-2026-42055)
- [nginx-gateway-fabric CHANGELOG (Release 2.6.4)](https://github.com/nginx/nginx-gateway-fabric/blob/main/CHANGELOG.md)
- [nginx-gateway-fabric PR 5467 (config validation hardening for 2.6.4)](https://github.com/nginx/nginx-gateway-fabric/pull/5467)
- [OffSeq Threat Radar - CVE-2026-50107 (NGINX Gateway Fabric config injection)](https://radar.offseq.com/threat/cve-2026-50107-cwe-74-improper-neutralization-of-s-17ac7f0e888e846a)
- [MITRE ATT&CK - T1190 Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0848