# F5 Patches Multiple NGINX Vulnerabilities: Heap Overflow, Memory Disclosure, and Use-After-Free (CVE-2026-42533, CVE-2026-60005, CVE-2026-56434)

> F5 disclosed and patched three NGINX vulnerabilities affecting NGINX Plus, NGINX Open Source, Ingress Controller, Gateway Fabric, App Protect WAF, and Instance Manager: a heap buffer overflow in the map directive triggered by regex capture-variable ordering (CVE-2026-42533, CVSS v4.0 9.2), an uninitialized memory disclosure in ngx_http_slice_module (CVE-2026-60005, CVSS v4.0 8.8), and a use-after-free in the SSI module requiring proxy_pass with buffering disabled plus a man-in-the-middle upstream (CVE-2026-56434, CVSS v4.0 8.3). No public PoC or active exploitation has been reported as of disclosure.

- **Published:** 2026-07-15T00:00:00Z
- **Last reviewed:** 2026-07-29T04:10:47.585Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1391
- **ID:** TL-2026-1391
- **Severity:** CRITICAL (CVSS 9.2)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 51 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-42533, CVE-2026-60005, CVE-2026-56434, CVE-2026-42945, CVE-2026-9256

## Description

On 2026-07-15, F5 published out-of-band security advisories disclosing three NGINX vulnerabilities patched in NGINX Open Source 1.30.4 / 1.31.3 and NGINX Plus 37.0.3.1 (R36 P7 / R33 branches).

CVE-2026-42533 (CWE-122, heap buffer overflow) arises when an administrator-configured `map` directive uses regex matching and a string expression references the map's regex capture variables before referencing the map's output variable (or, alternately, uses a non-cacheable variable in a string expression under certain conditions). An unauthenticated attacker who can influence which conditions are evaluated can send crafted HTTP requests that overflow a heap buffer in the NGINX worker process. On systems where ASLR is disabled or can be bypassed, this can escalate from a worker-process crash/DoS to remote code execution in the context of the NGINX worker. There is no control-plane exposure — this is strictly a data-plane (request-handling) issue. NVD lists CVSS v3.1 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and CVSS v4.0 9.2 (AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). Mitigation short of patching: convert unnamed regex captures used in map directives to named captures. Over a dozen independent researchers, including teams from AntAISecurityLab, EVO.company, and Vodafone Türkiye, are credited with independently reporting the issue.

CVE-2026-60005 (CWE-908, uninitialized resource) affects `ngx_http_slice_module`, a module that is NOT compiled in by default and requires the `--with-http_slice_module` build flag. When the `slice` directive is combined with unnamed regex captures, or during a background cache-update cycle, NGINX may read uninitialized heap memory into a response, letting an unauthenticated remote attacker who sends ordinary requests obtain a limited leak of worker-process memory content, or trigger a worker restart (DoS). NVD lists CVSS v3.1 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) and CVSS v4.0 8.8. F5 credits internal discovery. Mitigation short of patching: use named regex captures with slice.

CVE-2026-56434 (CWE-416, use-after-free) affects `ngx_http_ssi_module` (Server-Side Includes) and requires a specific configuration combination: SSI processing enabled, `proxy_pass` to an upstream, and `proxy_buffering off`. An attacker positioned as a man-in-the-middle able to control/manipulate the upstream response stream can trigger a use-after-free in the NGINX worker process during SSI directive processing of the unbuffered proxied response, leading to limited memory modification or a worker crash. NVD lists CVSS v4.0 8.3 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N) as primary, and CVSS v3.1 6.5 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H) as secondary — the v4 score is materially higher because v4 more heavily weights the network attack vector even with the MITM/adjacent-attacker precondition (AT:P). No configuration workaround exists; patching is required. Researcher p4p3r is credited with discovery.

All three vulnerabilities were shipped in the same out-of-band NGINX/F5 patch cycle (nginx-1.30.4 stable, nginx-1.31.3 mainline, and corresponding NGINX Plus / Ingress Controller / Gateway Fabric / App Protect WAF / Instance Manager branch fixes). F5 explicitly states BIG-IP, BIG-IQ, F5 Distributed Cloud, F5OS, and F5 AI Gateway are NOT affected — this advisory is scoped to the standalone NGINX product family and F5's NGINX-based Kubernetes/API-gateway/WAF offerings. This disclosure follows F5's prior June 2026 out-of-band NGINX patch cycle (CVE-2026-42530, a QUIC/HTTP-3 use-after-free, and CVE-2026-42055, an HPACK varint heap overflow in HTTP/2 proxy modules), both also CVSS 9.2, indicating a pattern of high-severity data-plane memory-safety issues surfacing in NGINX's HTTP request/response processing pipeline across 2026. As of disclosure, F5 reports no evidence of active exploitation or public proof-of-concept for any of the three CVEs in this bulletin, though the company separately notes that a recent unrelated NGINX rewrite-module flaw (CVE-2026-42945) was exploited within days of its own disclosure, underscoring the value of rapid patching given NGINX's ubiquity as public-facing infrastructure.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1499 Endpoint Denial of Service
- T1499.004 Application or System Exploitation
- T1489 Service Stop
- T1005 Data from Local System
- T1518 Software Discovery
- T1595 Active Scanning
- T1592 Gather Victim Host Information
- T1211 Exploitation for Stealth
- T1557 Adversary-in-the-Middle
- T1068 Exploitation for Privilege Escalation
- T1588.005 Exploits
- T1588.006 Vulnerabilities
- T1210 Exploitation of Remote Services
- T1059 Command and Scripting Interpreter
- T1587 Develop Capabilities
- T1082 System Information Discovery
- T1611 Escape to Host
- T1071 Application Layer Protocol
- T1041 Exfiltration Over C2 Channel
- T1685 Disable or Modify Tools
- T1016 System Network Configuration Discovery
- T1505 Server Software Component
- T1102 Web Service
- T1046 Network Service Discovery
- T1588.002 Obtain Capabilities: Tool
- T1552.001 Unsecured Credentials: Credentials In Files

## Sources

- [F5 Patches Multiple NGINX Vulnerabilities](https://cybersecuritynews.com/f5-patches-multiple-nginx-vulnerabilities/)
- [K000162097: NGINX ngx_http_map_module vulnerability CVE-2026-42533](https://my.f5.com/manage/s/article/K000162097)
- [K000162100: NGINX ngx_http_slice_module vulnerability CVE-2026-60005](https://my.f5.com/manage/s/article/K000162100)
- [K000162098: NGINX ngx_http_ssi_module vulnerability CVE-2026-56434](https://my.f5.com/manage/s/article/K000162098)
- [CVE-2026-42533 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-42533)
- [CVE-2026-60005 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-60005)
- [CVE-2026-56434 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-56434)
- [nginx news: 2026 (1.31.3 / 1.30.4 release notes)](https://nginx.org/2026.html)
- [nginx security advisories](https://nginx.org/en/security_advisories.html)
- [Nginx 1.31.3 Released: Critical Security Patches, Socket Tuning, and Protocol Hardening](https://www.linuxcompatible.org/story/nginx-1313-released-critical-security-patches-socket-tuning-and-protocol-hardening)
- [Nginx-1.30.4 stable and nginx-1.31.3 mainline versions released](https://community.nginx.org/t/nginx-1-30-4-stable-and-nginx-1-31-3-mainline-versions-released/10134)
- [F5 Patches Critical, High-Severity NGINX Vulnerabilities](https://www.securityweek.com/f5-patches-critical-high-severity-nginx-vulnerabilities/)
- [F5 issues out-of-band patches for critical NGINX vulnerabilities](https://www.bleepingcomputer.com/news/security/f5-issues-out-of-band-patches-for-critical-nginx-vulnerabilities/)
- [F5 Patches Two Critical NGINX Open Source Flaws Enabling Remote Code Execution](https://thehackernews.com/2026/06/f5-patches-two-critical-nginx-open.html)
- [18-Year-Old NGINX Rewrite Module Flaw Enables Unauthenticated RCE (CVE-2026-42945, prior exploited-in-the-wild NGINX flaw)](https://thehackernews.com/2026/05/18-year-old-nginx-rewrite-module-flaw.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1391