Latest Threats

F5 Patches Multiple NGINX Vulnerabilities: Heap Overflow, Memory Disclosure, and Use-After-Free (CVE-2026-42533, CVE-2026-60005, CVE-2026-56434) — Threadlinqs Intelligence

As of 2026-07-19, F5 Patches Multiple NGINX Vulnerabilities: Heap Overflow, Memory Disclosure, and Use-After-Free (CVE-2026-42533, CVE-2026-60005, CVE-2026-56434) is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 30 indicators of compromise.

Threat ID: TL-2026-1391 · Severity: CRITICAL · CVSS: 9.2 · Status: PATCHED · Category: VULNERABILITY

Updated: 2026-07-19 · 3 updates · revalidated 3× · latest source

F5 disclosed and patched three NGINX vulnerabilities affecting NGINX Plus, NGINX Open Source, Ingress Controller, Gateway Fabric, App Protect WAF, and Instance Manager: a heap buffer overflow in the

On 2026-07-15, F5 published out-of-band security advisories disclosing three NGINX vulnerabilities patched in NGINX Open Source 1.30.4 / 1.31.3 and NGINX Plus 37.0.3.1 (R36 P7 / R33 branches). CVE-2026-42533 (CWE-122, heap buffer overflow) arises when an administrator-configured `map` directive uses regex matching and a string expression references the map's regex capture variables before referencing the map's output variable (or, alternately, uses a non-cacheable variable in a string expression under certain conditions). An unauthenticated attacker who can influence which conditions are evaluated can send crafted HTTP requests that overflow a heap buffer in the NGINX worker process. On systems where ASLR is disabled or can be bypassed, this can escalate from a worker-process crash/DoS to remote code execution in the context of the NGINX worker. There is no control-plane exposure — this is strictly a data-plane (request-handling) issue. NVD lists CVSS v3.1 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and CVSS v4.0 9.2 (AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). Mitigation short of patching: convert unnamed regex captures used in map directives to named captures. Over a dozen independent researchers, including teams from AntAISecurityLab, EVO.company, and Vodafone Türkiye, are credited with independently reporting the issue. CVE-2026-60005 (CWE-908, uninitialized resource) affects `ngx_http_slice_module`, a module that is NOT compiled in by default and requires the `--with-http_slice_module` build flag. When the `slice` directive is combined with unnamed regex captures, or during a background cache-update cycle, NGINX may read uninitialized heap memory into a response, letting an unauthenticated remote attacker who sends ordinary requests obtain a limited leak of worker-process memory content, or trigger a worker restart (DoS). NVD lists CVSS v3.1 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) and CVSS v4.0 8.8. F5 credits internal discovery. Mitigation short of patching: use named regex captures with slice. CVE-2026-56434 (CWE-416, use-after-free) affects `ngx_http_ssi_module` (Server-Side Includes) and requires a specific configuration combination: SSI processing enabled, `proxy_pass` to an upstream, and `proxy_buffering off`. An attacker positioned as a man-in-the-middle able to control/manipulate the upstream response stream can trigger a use-after-free in the NGINX worker process during SSI directive processing of the unbuffered proxied response, leading to limited memory modification or a worker crash. NVD lists CVSS v4.0 8.3 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N) as primary, and CVSS v3.1 6.5 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H) as secondary — the v4 score is materially higher because v4 more heavily weights the network attack vector even with the MITM/adjacent-attacker precondition (AT:P). No configuration workaround exists; patching is required. Researcher p4p3r is credited with discovery. All three vulnerabilities were shipped in the same out-of-band NGINX/F5 patch cycle (nginx-1.30.4 stable, nginx-1.31.3 mainline, and corresponding NGINX Plus / Ingress Controller / Gateway Fabric / App Protect WAF / Instance Manager branch fixes). F5 explicitly states BIG-IP, BIG-IQ, F5 Distributed Cloud, F5OS, and F5 AI Gateway are NOT affected — this advisory is scoped to the standalone NGINX product family and F5's NGINX-based Kubernetes/API-gateway/WAF offerings. This disclosure follows F5's prior June 2026 out-of-band NGINX patch cycle (CVE-2026-42530, a QUIC/HTTP-3 use-after-free, and CVE-2026-42055, an HPACK varint heap overflow in HTTP/2 proxy modules), both also CVSS 9.2, indicating a pattern of high-severity data-plane memory-safety issues surfacing in NGINX's HTTP request/response processing pipeline across 2026. As of disclosure, F5 reports no evidence of active exploitation or public proof-of-concept for any of the three CVEs in this bulletin, though the company separately notes that a recent

MITRE ATT&CK Techniques

T1190 Exploit Public-Facing Application; T1203 Exploitation for Client Execution; T1499 Endpoint Denial of Service; T1499.004 Application or System Exploitation; T1489 Service Stop; T1005 Data from Local System; T1518 Software Discovery; T1595 Active Scanning; T1592 Gather Victim Host Information; T1211 Exploitation for Defense Evasion; T1557 Adversary-in-the-Middle; T1557 Adversary-in-the-Middle; T1068 Exploitation for Privilege Escalation; T1588.005 Obtain Capabilities; T1588.006 Obtain Capabilities; T1210 Exploitation of Remote Services; T1059 Command and Scripting Interpreter; T1587 Develop Capabilities; T1082 System Information Discovery; T1611 Escape to Host; T1071 Application Layer Protocol; T1041 Exfiltration Over C2 Channel; T1562 Impair Defenses; T1016 System Network Configuration Discovery; T1505 Server Software Component; T1102 Web Service; T1046 Network Service Discovery

Associated CVEs

CVE-2026-42533, CVE-2026-60005, CVE-2026-56434, CVE-2026-42945, CVE-2026-9256

Weaknesses (CWE)

CWE-122, CWE-908, CWE-416, CWE-787

Target sectors: technology, cloud-hosting, finance, health, government administration, ecommerce, telecoms, saas, critical-infrastructure

Target regions: Global

Update History

2026-07-19 — CVE-2026-42533: Critical NGINX Heap Buffer Overflow in Map Regex Handling Can Crash Workers, Enable RCE: What changed Severity reassessed HIGH → CRITICAL given confirmation the flaw is part of a 3-CVE family of architecturally identical two-pass expression-evaluation heap overflows (CVE-2026-42945, CVE-2026-9256) and that a named researcher ha
2026-07-19 — Multiple Nginx Vulnerabilities Patched (CVE-2026-42533, CVE-2026-56434, CVE-2026-60005): What changed No severity/exploitability/status change — still HIGH / THEORETICAL / PATCHED. This update adds regional CERT visibility. New indicators (2) 2 new entity IOCs: GovCERT.HK and HKCERT (Hong Kong CERTs that bulletined this same vu
2026-07-16 — CVE-2026-42533: NGINX Heap Buffer Overflow in map Directive Regex Matching: What changed No severity/exploitability/status escalation supported by new evidence — both reports agree on THEORETICAL exploitability, CRITICAL impact, and no active exploitation or KEV listing. The newer report's own 'CRITICAL' severity l

References

Detections & IOCs

As of 2026-07-26, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 30 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.

VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-42533, CVE-2026-60005, CVE-2026-56434, CVE-2026-42945, CVE-2026-9256, T1190, T1203, T1499, T1499.004, T1489, T1005, T1518, T1595, T1592, T1211

Threadlinqs Intelligence — Real-Time Threat Detection Platform

Latest Threats

🔄 Threat Comparison