Threat reportVulnerabilityTL-2026-1391

F5 Patches Multiple NGINX Vulnerabilities: Heap Overflow, Memory Disclosure, and Use-After-Free (CVE-2026-42533, CVE-2026-60005, CVE-2026-56434)

criticalPATCHED

F5 Patches Multiple NGINX Vulnerabilities (TL-2026-1391) is a critical-severity software vulnerability scored CVSS 9.2, first published 2026-07-15 and last reviewed 2026-07-29. It has no confirmed attribution, affects F5 NGINX Open Source, references 5 CVEs (CVE-2026-42533, CVE-2026-60005, CVE-2026-56434), maps to 28 MITRE ATT&CK techniques (T1005, T1016, T1041), and is covered by 9 detection rules and 51 indicators of compromise.

CVSS
9.2/10Critical
CVEs
5Referenced vulnerabilities
Techniques
28MITRE ATT&CK
Actors
0Not attributed
Detection rules
9SPL · KQL · Sigma
IOCs
51Indicators of compromise

Key facts for TL-2026-1391

Threat ID
TL-2026-1391
Severity
CRITICAL
CVSS
9.2 (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
Status
PATCHED
Category
VULNERABILITY
First published
Last reviewed
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
technology, cloud-hosting, finance, health, government administration, ecommerce, telecoms, saas, critical-infrastructure
Target regions
Global
Detection rules
9
Indicators of compromise
51
Updates
2026-07-29 · 5 updates · revalidated 5× · latest source

How F5 Patches Multiple NGINX Vulnerabilities works

F5 disclosed and patched three NGINX vulnerabilities affecting NGINX Plus, NGINX Open Source, Ingress Controller, Gateway Fabric, App Protect WAF, and Instance Manager: a heap buffer overflow in the map directive triggered by regex capture-variable ordering (CVE-2026-42533, CVSS v4.0 9.2), an uninitialized memory disclosure in ngx_http_slice_module (CVE-2026-60005, CVSS v4.0 8.8), and a use-after-free in the SSI module requiring proxy_pass with buffering disabled plus a man-in-the-middle upstream (CVE-2026-56434, CVSS v4.0 8.3). No public PoC or active exploitation has been reported as of disclosure.

On 2026-07-15, F5 published out-of-band security advisories disclosing three NGINX vulnerabilities patched in NGINX Open Source 1.30.4 / 1.31.3 and NGINX Plus 37.0.3.1 (R36 P7 / R33 branches).

CVE-2026-42533 (CWE-122, heap buffer overflow) arises when an administrator-configured `map` directive uses regex matching and a string expression references the map's regex capture variables before referencing the map's output variable (or, alternately, uses a non-cacheable variable in a string expression under certain conditions). An unauthenticated attacker who can influence which conditions are evaluated can send crafted HTTP requests that overflow a heap buffer in the NGINX worker process. On systems where ASLR is disabled or can be bypassed, this can escalate from a worker-process crash/DoS to remote code execution in the context of the NGINX worker. There is no control-plane exposure — this is strictly a data-plane (request-handling) issue. NVD lists CVSS v3.1 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and CVSS v4.0 9.2 (AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). Mitigation short of patching: convert unnamed regex captures used in map directives to named captures. Over a dozen independent researchers, including teams from AntAISecurityLab, EVO.company, and Vodafone Türkiye, are credited with independently reporting the issue.

CVE-2026-60005 (CWE-908, uninitialized resource) affects `ngx_http_slice_module`, a module that is NOT compiled in by default and requires the `--with-http_slice_module` build flag. When the `slice` directive is combined with unnamed regex captures, or during a background cache-update cycle, NGINX may read uninitialized heap memory into a response, letting an unauthenticated remote attacker who sends ordinary requests obtain a limited leak of worker-process memory content, or trigger a worker restart (DoS). NVD lists CVSS v3.1 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) and CVSS v4.0 8.8. F5 credits internal discovery. Mitigation short of patching: use named regex captures with slice.

CVE-2026-56434 (CWE-416, use-after-free) affects `ngx_http_ssi_module` (Server-Side Includes) and requires a specific configuration combination: SSI processing enabled, `proxy_pass` to an upstream, and `proxy_buffering off`. An attacker positioned as a man-in-the-middle able to control/manipulate the upstream response stream can trigger a use-after-free in the NGINX worker process during SSI directive processing of the unbuffered proxied response, leading to limited memory modification or a worker crash. NVD lists CVSS v4.0 8.3 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N) as primary, and CVSS v3.1 6.5 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H) as secondary — the v4 score is materially higher because v4 more heavily weights the network attack vector even with the MITM/adjacent-attacker precondition (AT:P). No configuration workaround exists; patching is required. Researcher p4p3r is credited with discovery.

All three vulnerabilities were shipped in the same out-of-band NGINX/F5 patch cycle (nginx-1.30.4 stable, nginx-1.31.3 mainline, and corresponding NGINX Plus / Ingress Controller / Gateway Fabric / App Protect WAF / Instance Manager branch fixes). F5 explicitly states BIG-IP, BIG-IQ, F5 Distributed Cloud, F5OS, and F5 AI Gateway are NOT affected — this advisory is scoped to the standalone NGINX product family and F5's NGINX-based Kubernetes/API-gateway/WAF offerings. This disclosure follows F5's prior June 2026 out-of-band NGINX patch cycle (CVE-2026-42530, a QUIC/HTTP-3 use-after-free, and CVE-2026-42055, an HPACK varint heap overflow in HTTP/2 proxy modules), both also CVSS 9.2, indicating a pattern of high-severity data-plane memory-safety issues surfacing in NGINX's HTTP request/response processing pipeline across 2026. As of disclosure, F5 reports no evidence of active exploitation or public proof-of-concept for any of the three CVEs in this bulletin, though the company separately notes that a recent unrelated NGINX rewrite-module flaw (CVE-2026-42945) was exploited within days of its own disclosure, underscoring the value of rapid patching given NGINX's ubiquity as public-facing infrastructure.

MITRE ATT&CK techniques used in TL-2026-1391

Collection

T1005 Data from Local System; T1557 Adversary-in-the-Middle

Discovery

T1016 System Network Configuration Discovery; T1046 Network Service Discovery; T1082 System Information Discovery; T1518 Software Discovery

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1611 Escape to Host

Command and Control

T1071 Application Layer Protocol; T1102 Web Service

Initial Access

T1190 Exploit Public-Facing Application

Lateral Movement

T1210 Exploitation of Remote Services

Defense Evasion

T1211 Exploitation for Stealth

Impact

T1489 Service Stop; T1499 Endpoint Denial of Service; T1499.004 Application or System Exploitation

Persistence

T1505 Server Software Component

Credential Access

T1552.001 Unsecured Credentials: Credentials In Files

Resource Development

T1587 Develop Capabilities; T1588.002 Obtain Capabilities: Tool; T1588.005 Exploits; T1588.006 Vulnerabilities

Reconnaissance

T1592 Gather Victim Host Information; T1595 Active Scanning

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in F5 Patches Multiple NGINX Vulnerabilities

  • F5 — NGINX Open Source
    Vulnerable versions: 0.9.6-1.30.4 (CVE-2026-42533); 1.31.2 (CVE-2026-42533); 0.8.11-1.30.4 (CVE-2026-56434); 1.31.2-1.31.3 (CVE-2026-56434); builds with --with-http_slice_module prior to fix (CVE-2026-60005)
    Fixed in: 1.30.4; 1.31.3
  • F5 — NGINX Plus
    Vulnerable versions: prior to 37.0.3.1; R36 prior to P7; R33 prior to fix
    Fixed in: 37.0.3.1; R36 P7; R33 (patched)
  • F5 — NGINX Ingress Controller
    Vulnerable versions: releases prior to fix per K000162097/K000162098/K000162100
    Fixed in: fix rolling out per branch, see F5 advisories
  • F5 — NGINX Gateway Fabric
    Vulnerable versions: releases prior to fix per F5 advisories
    Fixed in: fix rolling out per branch, see F5 advisories
  • F5 — NGINX App Protect WAF
    Vulnerable versions: releases prior to fix per F5 advisories
    Fixed in: fix rolling out per branch, see F5 advisories
  • F5 — NGINX Instance Manager
    Vulnerable versions: releases prior to fix per F5 advisories
    Fixed in: fix rolling out per branch, see F5 advisories
  • F5 — BIG-IP / BIG-IQ / F5 Distributed Cloud / F5OS / F5 AI Gateway
    Fixed in: not affected — explicitly out of scope per F5 advisory

Remediation for F5 Patches Multiple NGINX Vulnerabilities

Patches

  • NGINX Open Source 1.31.3 / 1.30.4
  • NGINX Plus 37.0.3.1 / R36 P7 / R33
  • F5 advisory K000162097 (CVE-2026-42533)
  • F5 advisory K000162100 (CVE-2026-60005)
  • F5 advisory K000162098 (CVE-2026-56434)

Immediate actions

  • Upgrade NGINX Open Source to 1.31.3 (mainline) or 1.30.4 (stable)
  • Upgrade NGINX Plus to release 37.0.3.1, R36 P7, or R33
  • Update NGINX Ingress Controller, Gateway Fabric, App Protect WAF, and Instance Manager to the fixed branch releases per F5 advisories K000162097, K000162098, K000162100
  • Inventory all NGINX deployments (standalone, containerized, Ingress Controller, Gateway Fabric) for exposure before prioritizing patch rollout

Workarounds

  • CVE-2026-42533: convert unnamed regex captures referenced in map directive string expressions to named captures
  • CVE-2026-60005: use named regex captures instead of unnamed captures when the slice directive is configured
  • CVE-2026-56434: no configuration workaround exists; patching is mandatory
  • As a defense-in-depth stopgap, disable ngx_http_slice_module (do not build with --with-http_slice_module) if the feature is unused, to fully avoid CVE-2026-60005 exposure

Longer-term hardening

  • Enable ASLR on all hosts running NGINX to blunt heap-overflow-to-RCE escalation for CVE-2026-42533
  • Restrict who can author/modify nginx.conf map, slice, and ssi directive configuration, since two of the three issues are configuration-dependent
  • Monitor for unexpected NGINX worker process restarts/crashes as a leading indicator of exploitation attempts
  • Establish TLS/certificate validation and network segmentation between NGINX and upstream servers to reduce MITM exposure relevant to CVE-2026-56434

CVEs associated with F5 Patches Multiple NGINX Vulnerabilities

CVE-2026-42533, CVE-2026-60005, CVE-2026-56434, CVE-2026-42945, CVE-2026-9256

Weaknesses (CWE) in F5 Patches Multiple NGINX Vulnerabilities

CWE-122, CWE-908, CWE-416, CWE-787

Timeline of F5 Patches Multiple NGINX Vulnerabilities

Showing the 20 most recent tracked events.

  • HKCERT publishes an earlier 'Nginx Multiple Vulnerabilities' bulletin covering this same CVE batch, establishing regional (Hong Kong) awareness ahead of the F5 disclosure.
  • nginx.org CHANGES file for 1.31.3 publishes the exact vulnerability wording for CVE-2026-42533 (map variable referenced in a string expression after a capture affected by that map, or a non-cacheable variable used in a string expression), crediting Mufeed VH of Winfunc Research and nginx co-maintainer Maxim Dounin.
  • No public proof-of-concept exploit code identified for CVE-2026-42533, CVE-2026-60005, or CVE-2026-56434 as of disclosure.
  • Threadlinqs research confirms none of the three CVEs appear in the CISA Known Exploited Vulnerabilities catalog as of this date.
  • Cyber Security News publishes coverage of the F5 NGINX patch bulletin, the source article that triggered this threat record.
  • nginx.org publishes 2026 news entry and CHANGES log documenting the 1.30.4 stable and 1.31.3 mainline releases containing fixes for all three vulnerabilities.
  • F5 publishes advisories K000162097, K000162098, and K000162100 disclosing CVE-2026-42533, CVE-2026-56434, and CVE-2026-60005 respectively, alongside patched NGINX Open Source (1.30.4/1.31.3) and NGINX Plus (37.0.3.1/R36 P7/R33) releases.
  • NVD publishes and last-modifies the CVE-2026-42533 record with CVSS v3.1 (8.1) and v4.0 (9.2) scoring.
  • CCB Belgium issues a parallel advisory ('Warning: Multiple Vulnerabilities in NGINX Components, Patch Immediately!') reiterating the patch guidance.
  • GovCERT.HK issues Alert A26-07-27 summarizing the three patched vulnerabilities and urging administrators to apply vendor fixes immediately.
  • SOC Prime publishes an independent analysis of CVE-2026-42533, flagging it as a critical, unauthenticated, remotely reachable heap buffer overflow with no public PoC or IOCs at time of writing.
  • Hosting-control-panel and sysadmin communities (Plesk, DirectAdmin forums) begin discussing the newly disclosed nginx CVEs and urging upgrades.
  • The Hacker News publishes coverage of CVE-2026-42533 summarizing the vulnerability, affected versions, and patch guidance.
  • Researcher Stan Shaw (cyberstan) publishes the public CVE-2026-42533-Config-Scanner tool and states a full PoC will follow 21 days post-patch; SC World and IONIX publish technical briefs; Rescana notes no confirmed in-the-wild exploitation or APT attribution as of this date.
  • No public proof-of-concept exists as of this date; independent researcher Stan Shaw (cyberstan) has privately demonstrated a working exploit with 10/10 reliability, including an ASLR bypass on default Ubuntu 24.04, but is withholding release pending a 21-day disclosure window post-patch.
  • Independent researcher publishes a Docker-based reproduction of the information-leak and heap-overflow primitives against nginx 1.30.3 vs. patched 1.30.4.
  • Stan Shaw open-sources the full technical exploitation writeup and RCE proof-of-concept detailing all 13 vulnerable call sites and the ASLR-bypass exploit chain.
  • CISA KEV catalog (version 2026.07.27, 1,655 entries) reconfirmed to not list CVE-2026-42533; no CISA-confirmed active exploitation to date.
  • Depth First Disclosures releases the 'Nginx-Rift' full-chain exploit PoC on GitHub, combining the ASLR-bypassing information leak with the heap overflow to achieve reliable pre-auth RCE for CVE-2026-42533, bundled with related sibling CVEs (-42530, -42945, -42946, -40701, -42934).
  • GBHackers publishes coverage of the Nginx-Rift PoC release. CVE-2026-42533 remains absent from the CISA KEV catalog as of this date; no confirmed in-the-wild exploitation reported.

Update history for TL-2026-1391

Sources cited for F5 Patches Multiple NGINX Vulnerabilities

Detection coverage for TL-2026-1391

As of 2026-07-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1391 across Splunk SPL, Microsoft KQL and Sigma, covering 51 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

9 detection rules (Splunk SPL, Microsoft KQL, Sigma) · Blue and above. Compare plans
51 indicators of compromise · Red and above. Compare plans

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level
Fig. 01 · Threat weatherIndexing the archive…
1 square = 1 threat · click to open

Latest Threats