F5 Patches Multiple NGINX Vulnerabilities: Heap Overflow, Memory Disclosure, and Use-After-Free (CVE-2026-42533, CVE-2026-60005, CVE-2026-56434)
F5 Patches Multiple NGINX Vulnerabilities (TL-2026-1391) is a critical-severity software vulnerability scored CVSS 9.2, first published 2026-07-15 and last reviewed 2026-07-29. It has no confirmed attribution, affects F5 NGINX Open Source, references 5 CVEs (CVE-2026-42533, CVE-2026-60005, CVE-2026-56434), maps to 28 MITRE ATT&CK techniques (T1005, T1016, T1041), and is covered by 9 detection rules and 51 indicators of compromise.
Key facts for TL-2026-1391
- Threat ID
- TL-2026-1391
- Severity
- CRITICAL
- CVSS
- 9.2 (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- 2026-07-15
- Last reviewed
- 2026-07-29
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, cloud-hosting, finance, health, government administration, ecommerce, telecoms, saas, critical-infrastructure
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 51
- Updates
- 2026-07-29 · 5 updates · revalidated 5× · latest source
F5 disclosed and patched three NGINX vulnerabilities affecting NGINX Plus, NGINX Open Source, Ingress Controller, Gateway Fabric, App Protect WAF, and Instance Manager: a heap buffer overflow in the map directive triggered by regex capture-variable ordering (CVE-2026-42533, CVSS v4.0 9.2), an uninitialized memory disclosure in ngx_http_slice_module (CVE-2026-60005, CVSS v4.0 8.8), and a use-after-free in the SSI module requiring proxy_pass with buffering disabled plus a man-in-the-middle upstream (CVE-2026-56434, CVSS v4.0 8.3). No public PoC or active exploitation has been reported as of disclosure.
How F5 Patches Multiple NGINX Vulnerabilities works
On 2026-07-15, F5 published out-of-band security advisories disclosing three NGINX vulnerabilities patched in NGINX Open Source 1.30.4 / 1.31.3 and NGINX Plus 37.0.3.1 (R36 P7 / R33 branches).
CVE-2026-42533 (CWE-122, heap buffer overflow) arises when an administrator-configured `map` directive uses regex matching and a string expression references the map's regex capture variables before referencing the map's output variable (or, alternately, uses a non-cacheable variable in a string expression under certain conditions). An unauthenticated attacker who can influence which conditions are evaluated can send crafted HTTP requests that overflow a heap buffer in the NGINX worker process. On systems where ASLR is disabled or can be bypassed, this can escalate from a worker-process crash/DoS to remote code execution in the context of the NGINX worker. There is no control-plane exposure — this is strictly a data-plane (request-handling) issue. NVD lists CVSS v3.1 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and CVSS v4.0 9.2 (AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). Mitigation short of patching: convert unnamed regex captures used in map directives to named captures. Over a dozen independent researchers, including teams from AntAISecurityLab, EVO.company, and Vodafone Türkiye, are credited with independently reporting the issue.
CVE-2026-60005 (CWE-908, uninitialized resource) affects `ngx_http_slice_module`, a module that is NOT compiled in by default and requires the `--with-http_slice_module` build flag. When the `slice` directive is combined with unnamed regex captures, or during a background cache-update cycle, NGINX may read uninitialized heap memory into a response, letting an unauthenticated remote attacker who sends ordinary requests obtain a limited leak of worker-process memory content, or trigger a worker restart (DoS). NVD lists CVSS v3.1 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) and CVSS v4.0 8.8. F5 credits internal discovery. Mitigation short of patching: use named regex captures with slice.
CVE-2026-56434 (CWE-416, use-after-free) affects `ngx_http_ssi_module` (Server-Side Includes) and requires a specific configuration combination: SSI processing enabled, `proxy_pass` to an upstream, and `proxy_buffering off`. An attacker positioned as a man-in-the-middle able to control/manipulate the upstream response stream can trigger a use-after-free in the NGINX worker process during SSI directive processing of the unbuffered proxied response, leading to limited memory modification or a worker crash. NVD lists CVSS v4.0 8.3 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N) as primary, and CVSS v3.1 6.5 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H) as secondary — the v4 score is materially higher because v4 more heavily weights the network attack vector even with the MITM/adjacent-attacker precondition (AT:P). No configuration workaround exists; patching is required. Researcher p4p3r is credited with discovery.
All three vulnerabilities were shipped in the same out-of-band NGINX/F5 patch cycle (nginx-1.30.4 stable, nginx-1.31.3 mainline, and corresponding NGINX Plus / Ingress Controller / Gateway Fabric / App Protect WAF / Instance Manager branch fixes). F5 explicitly states BIG-IP, BIG-IQ, F5 Distributed Cloud, F5OS, and F5 AI Gateway are NOT affected — this advisory is scoped to the standalone NGINX product family and F5's NGINX-based Kubernetes/API-gateway/WAF offerings. This disclosure follows F5's prior June 2026 out-of-band NGINX patch cycle (CVE-2026-42530, a QUIC/HTTP-3 use-after-free, and CVE-2026-42055, an HPACK varint heap overflow in HTTP/2 proxy modules), both also CVSS 9.2, indicating a pattern of high-severity data-plane memory-safety issues surfacing in NGINX's HTTP request/response processing pipeline across 2026. As of disclosure, F5 reports no evidence of active exploitation or public proof-of-concept for any of the three CVEs in this bulletin, though the company separately notes that a recent unrelated NGINX rewrite-module flaw (CVE-2026-42945) was exploited within days of its own disclosure, underscoring the value of rapid patching given NGINX's ubiquity as public-facing infrastructure.
MITRE ATT&CK techniques used in TL-2026-1391
Collection
T1005 Data from Local System; T1557 Adversary-in-the-Middle
Discovery
T1016 System Network Configuration Discovery; T1046 Network Service Discovery; T1082 System Information Discovery; T1518 Software Discovery
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution
Privilege Escalation
T1068 Exploitation for Privilege Escalation; T1611 Escape to Host
Command and Control
T1071 Application Layer Protocol; T1102 Web Service
Initial Access
T1190 Exploit Public-Facing Application
Lateral Movement
T1210 Exploitation of Remote Services
Defense Evasion
T1211 Exploitation for Stealth
Impact
T1489 Service Stop; T1499 Endpoint Denial of Service; T1499.004 Application or System Exploitation
Persistence
T1505 Server Software Component
Credential Access
T1552.001 Unsecured Credentials: Credentials In Files
Resource Development
T1587 Develop Capabilities; T1588.002 Obtain Capabilities: Tool; T1588.005 Exploits; T1588.006 Vulnerabilities
Reconnaissance
T1592 Gather Victim Host Information; T1595 Active Scanning
defense-impairment
Affected products and versions in F5 Patches Multiple NGINX Vulnerabilities
- F5 — NGINX Open Source
Vulnerable versions: 0.9.6-1.30.4 (CVE-2026-42533); 1.31.2 (CVE-2026-42533); 0.8.11-1.30.4 (CVE-2026-56434); 1.31.2-1.31.3 (CVE-2026-56434); builds with --with-http_slice_module prior to fix (CVE-2026-60005)
Fixed in: 1.30.4; 1.31.3 - F5 — NGINX Plus
Vulnerable versions: prior to 37.0.3.1; R36 prior to P7; R33 prior to fix
Fixed in: 37.0.3.1; R36 P7; R33 (patched) - F5 — NGINX Ingress Controller
Vulnerable versions: releases prior to fix per K000162097/K000162098/K000162100
Fixed in: fix rolling out per branch, see F5 advisories - F5 — NGINX Gateway Fabric
Vulnerable versions: releases prior to fix per F5 advisories
Fixed in: fix rolling out per branch, see F5 advisories - F5 — NGINX App Protect WAF
Vulnerable versions: releases prior to fix per F5 advisories
Fixed in: fix rolling out per branch, see F5 advisories - F5 — NGINX Instance Manager
Vulnerable versions: releases prior to fix per F5 advisories
Fixed in: fix rolling out per branch, see F5 advisories - F5 — BIG-IP / BIG-IQ / F5 Distributed Cloud / F5OS / F5 AI Gateway
Fixed in: not affected — explicitly out of scope per F5 advisory
Remediation for F5 Patches Multiple NGINX Vulnerabilities
Patches
- NGINX Open Source 1.31.3 / 1.30.4
- NGINX Plus 37.0.3.1 / R36 P7 / R33
- F5 advisory K000162097 (CVE-2026-42533)
- F5 advisory K000162100 (CVE-2026-60005)
- F5 advisory K000162098 (CVE-2026-56434)
Immediate actions
- Upgrade NGINX Open Source to 1.31.3 (mainline) or 1.30.4 (stable)
- Upgrade NGINX Plus to release 37.0.3.1, R36 P7, or R33
- Update NGINX Ingress Controller, Gateway Fabric, App Protect WAF, and Instance Manager to the fixed branch releases per F5 advisories K000162097, K000162098, K000162100
- Inventory all NGINX deployments (standalone, containerized, Ingress Controller, Gateway Fabric) for exposure before prioritizing patch rollout
Workarounds
- CVE-2026-42533: convert unnamed regex captures referenced in map directive string expressions to named captures
- CVE-2026-60005: use named regex captures instead of unnamed captures when the slice directive is configured
- CVE-2026-56434: no configuration workaround exists; patching is mandatory
- As a defense-in-depth stopgap, disable ngx_http_slice_module (do not build with --with-http_slice_module) if the feature is unused, to fully avoid CVE-2026-60005 exposure
Longer-term hardening
- Enable ASLR on all hosts running NGINX to blunt heap-overflow-to-RCE escalation for CVE-2026-42533
- Restrict who can author/modify nginx.conf map, slice, and ssi directive configuration, since two of the three issues are configuration-dependent
- Monitor for unexpected NGINX worker process restarts/crashes as a leading indicator of exploitation attempts
- Establish TLS/certificate validation and network segmentation between NGINX and upstream servers to reduce MITM exposure relevant to CVE-2026-56434
CVEs associated with F5 Patches Multiple NGINX Vulnerabilities
CVE-2026-42533, CVE-2026-60005, CVE-2026-56434, CVE-2026-42945, CVE-2026-9256
Weaknesses (CWE) in F5 Patches Multiple NGINX Vulnerabilities
CWE-122, CWE-908, CWE-416, CWE-787
Timeline of F5 Patches Multiple NGINX Vulnerabilities
Showing the 20 most recent tracked events.
- HKCERT publishes an earlier 'Nginx Multiple Vulnerabilities' bulletin covering this same CVE batch, establishing regional (Hong Kong) awareness ahead of the F5 disclosure.
- nginx.org CHANGES file for 1.31.3 publishes the exact vulnerability wording for CVE-2026-42533 (map variable referenced in a string expression after a capture affected by that map, or a non-cacheable variable used in a string expression), crediting Mufeed VH of Winfunc Research and nginx co-maintainer Maxim Dounin.
- No public proof-of-concept exploit code identified for CVE-2026-42533, CVE-2026-60005, or CVE-2026-56434 as of disclosure.
- Threadlinqs research confirms none of the three CVEs appear in the CISA Known Exploited Vulnerabilities catalog as of this date.
- Cyber Security News publishes coverage of the F5 NGINX patch bulletin, the source article that triggered this threat record.
- nginx.org publishes 2026 news entry and CHANGES log documenting the 1.30.4 stable and 1.31.3 mainline releases containing fixes for all three vulnerabilities.
- F5 publishes advisories K000162097, K000162098, and K000162100 disclosing CVE-2026-42533, CVE-2026-56434, and CVE-2026-60005 respectively, alongside patched NGINX Open Source (1.30.4/1.31.3) and NGINX Plus (37.0.3.1/R36 P7/R33) releases.
- NVD publishes and last-modifies the CVE-2026-42533 record with CVSS v3.1 (8.1) and v4.0 (9.2) scoring.
- CCB Belgium issues a parallel advisory ('Warning: Multiple Vulnerabilities in NGINX Components, Patch Immediately!') reiterating the patch guidance.
- GovCERT.HK issues Alert A26-07-27 summarizing the three patched vulnerabilities and urging administrators to apply vendor fixes immediately.
- SOC Prime publishes an independent analysis of CVE-2026-42533, flagging it as a critical, unauthenticated, remotely reachable heap buffer overflow with no public PoC or IOCs at time of writing.
- Hosting-control-panel and sysadmin communities (Plesk, DirectAdmin forums) begin discussing the newly disclosed nginx CVEs and urging upgrades.
- The Hacker News publishes coverage of CVE-2026-42533 summarizing the vulnerability, affected versions, and patch guidance.
- Researcher Stan Shaw (cyberstan) publishes the public CVE-2026-42533-Config-Scanner tool and states a full PoC will follow 21 days post-patch; SC World and IONIX publish technical briefs; Rescana notes no confirmed in-the-wild exploitation or APT attribution as of this date.
- No public proof-of-concept exists as of this date; independent researcher Stan Shaw (cyberstan) has privately demonstrated a working exploit with 10/10 reliability, including an ASLR bypass on default Ubuntu 24.04, but is withholding release pending a 21-day disclosure window post-patch.
- Independent researcher publishes a Docker-based reproduction of the information-leak and heap-overflow primitives against nginx 1.30.3 vs. patched 1.30.4.
- Stan Shaw open-sources the full technical exploitation writeup and RCE proof-of-concept detailing all 13 vulnerable call sites and the ASLR-bypass exploit chain.
- CISA KEV catalog (version 2026.07.27, 1,655 entries) reconfirmed to not list CVE-2026-42533; no CISA-confirmed active exploitation to date.
- Depth First Disclosures releases the 'Nginx-Rift' full-chain exploit PoC on GitHub, combining the ASLR-bypassing information leak with the heap overflow to achieve reliable pre-auth RCE for CVE-2026-42533, bundled with related sibling CVEs (-42530, -42945, -42946, -40701, -42934).
- GBHackers publishes coverage of the Nginx-Rift PoC release. CVE-2026-42533 remains absent from the CISA KEV catalog as of this date; no confirmed in-the-wild exploitation reported.
Update history for TL-2026-1391
- 2026-07-29 — CVE-2026-42533: NGINX Heap Buffer Overflow via Two-Pass Regex Capture-State Clobbering in map/ssl_preread Script Engine (Pre-Auth RCE PoC Released): What changed No field escalation — existing record already carries CVSS v4.0 9.2 / CRITICAL / POC_PUBLIC / PATCHED, which matches or exceeds this report's own scoring (CVSS v3.1 8.1 / HIGH). This is a pure additive update: a second, indepen
- 2026-07-28 — CVE-2026-42533: NGINX Heap Buffer Overflow in Regex Map Directive Enables Pre-Auth DoS and Conditional RCE: What changed Exploitability escalated from THEORETICAL to POC_PUBLIC after independent researcher Stan Shaw (cyberstan) published a full technical writeup and working RCE PoC on 2026-07-25, preceded by a public config-scanner tool (2026-07-
- 2026-07-19 — CVE-2026-42533: Critical NGINX Heap Buffer Overflow in Map Regex Handling Can Crash Workers, Enable RCE: What changed Severity reassessed HIGH → CRITICAL given confirmation the flaw is part of a 3-CVE family of architecturally identical two-pass expression-evaluation heap overflows (CVE-2026-42945, CVE-2026-9256) and that a named researcher ha
- 2026-07-19 — Multiple Nginx Vulnerabilities Patched (CVE-2026-42533, CVE-2026-56434, CVE-2026-60005): What changed No severity/exploitability/status change — still HIGH / THEORETICAL / PATCHED. This update adds regional CERT visibility. New indicators (2) 2 new entity IOCs: GovCERT.HK and HKCERT (Hong Kong CERTs that bulletined this same vu
- 2026-07-16 — CVE-2026-42533: NGINX Heap Buffer Overflow in map Directive Regex Matching: What changed No severity/exploitability/status escalation supported by new evidence — both reports agree on THEORETICAL exploitability, CRITICAL impact, and no active exploitation or KEV listing. The newer report's own 'CRITICAL' severity l
Sources cited for F5 Patches Multiple NGINX Vulnerabilities
- F5 Patches Multiple NGINX Vulnerabilities
- K000162097: NGINX ngx_http_map_module vulnerability CVE-2026-42533
- K000162100: NGINX ngx_http_slice_module vulnerability CVE-2026-60005
- K000162098: NGINX ngx_http_ssi_module vulnerability CVE-2026-56434
- CVE-2026-42533 Detail - NVD
- CVE-2026-60005 Detail - NVD
- CVE-2026-56434 Detail - NVD
- nginx news: 2026 (1.31.3 / 1.30.4 release notes)
- nginx security advisories
- Nginx 1.31.3 Released: Critical Security Patches, Socket Tuning, and Protocol Hardening
- Nginx-1.30.4 stable and nginx-1.31.3 mainline versions released
- F5 Patches Critical, High-Severity NGINX Vulnerabilities
- F5 issues out-of-band patches for critical NGINX vulnerabilities
- F5 Patches Two Critical NGINX Open Source Flaws Enabling Remote Code Execution
- 18-Year-Old NGINX Rewrite Module Flaw Enables Unauthenticated RCE (CVE-2026-42945, prior exploited-in-the-wild NGINX flaw)
Threats related to F5 Patches Multiple NGINX Vulnerabilities
- NGINX Rift — CVE-2026-42945 Heap Buffer Overflow in ngx_http_rewrite_module (CVSS v4 9.2 Critical, 18-Year-Old Pre-Auth RCE, Public PoC)
- F5 Out-of-Band Patches for Critical NGINX HTTP/3 Use-After-Free and Proxy/gRPC Heap Overflow (CVE-2026-42530, CVE-2026-42055) plus NGINX Gateway Fabric Config Injection (CVE-2026-11311, CVE-2026-50107)
- Nginx-poolslip CVE-2026-9256 — Pre-Auth Heap Buffer Overflow in NGINX ngx_http_rewrite_module (Patch Bypass of CVE-2026-42945 'NGINX Rift')
- CVE-2026-8037: Pre-Auth Command Injection RCE in Progress Kemp LoadMaster via Uninitialized-Heap escape_quotes() Flaw on /accessv2
- Multiple Zscaler Client Connector Flaws Enable Remote Code Execution (CVE-2026-59568)
- CVE-2026-64561 — Zapscape: KVM/x86 Shadow MMU Use-After-Free Allows L1 Guest Escape to Linux Host
Detection coverage for TL-2026-1391
As of 2026-07-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1391 across Splunk SPL, Microsoft KQL and Sigma, covering 51 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.