F5 Patches Multiple NGINX, BIG-IP Vulnerabilities

1. Executive summary

F5 released an out-of-band security rollout on 16 July 2026 patching eight vulnerabilities across NGINX Open Source, NGINX Plus, NGINX Ingress Controller, and BIG-IP. The most severe is CVE-2026-42533 (CVSS 9.2, critical), a heap buffer overflow in NGINX exploitable by unauthenticated attackers via crafted HTTP requests, which can restart the worker process and potentially achieve code execution on systems with ASLR disabled. Additional high-severity flaws enable memory disclosure, use-after-free conditions, configuration injection, and denial-of-service. F5 states none of the vulnerabilities are known to be exploited in the wild. EMEA financial services running NGINX as edge/load-balancing infrastructure or BIG-IP with HTTP/2 profiles should treat patching as time-critical given the unauthenticated, remote nature of the top flaws.

2. Regulatory framing

3. Technical analysis & attack chain

Note on data confidence: No verified CVE reference data (CVSS vectors, CISA-KEV status, CWE classifications) was resolved for this item. CVSS scores and severity ratings below are taken from the SecurityWeek source citing F5's advisory. These are single-sourced (F5 vendor notification via SecurityWeek); verify against the F5 security advisory before enforcement.

CVE-2026-42533 — NGINX / NGINX Plus heap buffer overflow (CVSS 9.2, Critical)

Affected products: NGINX Plus, NGINX Open Source (specific versions not stated in source material).

Vulnerability mechanism: A heap buffer overflow occurs when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. The same condition can be triggered by using a non-cacheable variable in a string expression under certain conditions. This is a configuration-dependent flaw — the vulnerable code path is reached only when specific map directive patterns are present in the NGINX configuration.

Attack chain

1. Reconnaissance: Attacker identifies an internet-facing NGINX or NGINX Plus instance. No authentication is required, but the attacker cannot control the preconditions (specific map directive configuration with regex capture variable referencing order).
2. Crafted HTTP request delivery: Attacker sends a crafted HTTP request designed to trigger the vulnerable map directive code path — the request must reach a location where the affected map regex matching and string expression evaluation occurs.
3. Heap buffer overflow: The crafted input triggers the heap buffer overflow in the NGINX worker process.
4. Worker process restart: Under standard conditions, the overflow causes the NGINX worker process to restart (denial-of-service impact).
5. Potential code execution: On systems with ASLR disabled, the attacker can achieve arbitrary code execution. On ASLR-enabled systems (the default on modern Linux), exploitation is limited to crash/restart.

Key technical detail: The vulnerability is exploitable without authentication but only under conditions the attacker cannot directly control — meaning the NGINX configuration must already contain the vulnerable map directive pattern. This limits the attack surface to instances with specific configurations, but financial institutions using complex NGINX configurations (common for API gateways, reverse proxies, and load balancers) are more likely to have such patterns.

High-severity NGINX vulnerabilities

ngx_http_slice_module: An unauthenticated weakness allows attackers to leak memory contents and restart the NGINX worker process.

ngx_http_ssi_module: An unauthenticated weakness can cause a use-after-free in the NGINX worker process, enabling memory modification or process restart.

High-severity NGINX Ingress Controller vulnerabilities

Two vulnerabilities requiring authenticated access allow attackers to:

• Inject arbitrary NGINX configuration directives to delete files and disable services.
• Create or modify Ingress or TransportServer resources to cause a DoS condition.

High-severity BIG-IP vulnerability

A remote, unauthenticated vulnerability allows attackers to increase memory resource utilization when an HTTP/2 profile is configured on a virtual server, causing a denial-of-service condition.

BSI advisories (WID-SEC-2026-1995, WID-SEC-2026-2383): Germany's BSI has issued high-severity advisories for NGINX/NGINX Plus covering data manipulation, arbitrary code execution, information disclosure, and denial-of-service — consistent with the F5 advisory scope.

4. Mitigation & containment

P1 — Within 24 hours

1. Inventory NGINX deployments: Identify all NGINX Open Source, NGINX Plus, NGINX Ingress Controller, and BIG-IP instances across the estate, including those embedded in third-party appliances or container images. Prioritise internet-facing instances.
2. Audit for vulnerable map configurations (CVE-2026-42533): Search NGINX configurations for map directives using regex matching where regex capture variables are referenced before the map output variable in string expressions. Example grep: bash grep -rn 'map.*~' /etc/nginx/ && grep -rn '\$map.*\$[0-9]' /etc/nginx/ Instances with matching patterns are at highest risk and should be patched first.
3. Apply F5 out-of-band patches: Patch all NGINX Plus and NGINX Open Source instances to the fixed versions referenced in F5's out-of-band security notification. Consult F5's advisory for exact fixed version numbers.
4. Patch BIG-IP instances with HTTP/2 profiles: Apply the BIG-IP fix to all virtual servers configured with an HTTP/2 profile. As an interim containment measure, consider disabling HTTP/2 on non-critical virtual servers where feasible to eliminate the DoS attack surface.

P2 — Within 72 hours

5. Patch NGINX Ingress Controller: Update to the fixed version. Review RBAC controls for authenticated users who can create or modify Ingress and TransportServer resources — restrict to operational necessity.
6. Patch ngx_http_slice_module and ngx_http_ssi_module exposures: If the slice module or SSI module is not required, disable them as a containment measure: nginx # Remove or comment out: slice directive in configurations # Disable SSI: ssi off; Then apply the vendor patch.
7. Enable/verify ASLR: Confirm ASLR is enabled on all NGINX host systems to reduce CVE-2026-42533 impact from code execution to crash/restart: bash cat /proc/sys/kernel/randomize_va_space # Expected output: 2

P3 — Within 7 days

8. Verify patch deployment: Run vulnerability scans against all patched instances to confirm remediation.
9. Update WAF rules: Configure WAF rules to detect and block anomalous HTTP requests targeting map directive regex patterns, SSI includes, and slice module responses — defence-in-depth for any unpatched or shadow NGINX instances.
10. Review container image baselines: Update base container images including NGINX to ensure new deployments inherit patched versions.

5. Indicators of compromise

No indicators of compromise available in the source material. F5 states none of the vulnerabilities are known to be exploited in the wild, and no IOCs (IPs, domains, hashes, URLs) were provided in the source reporting.

Behavioural indicators

6. Detection

Insufficient indicators to author detection rules. The source material describes vulnerability mechanisms and affected components but does not provide specific exploit artefacts (distinctive strings, command-line flags, file paths, registry keys, or hard-coded values) that would appear in malicious files or traffic. CVE identifiers and module names are not threat artefacts and cannot be used as YARA/Sigma detection strings.

7. Sources

• SecurityWeek — "F5 Patches Multiple NGINX, BIG-IP Vulnerabilities" — https://www.securityweek.com/f5-patches-multiple-nginx-big-ip-vulnerabilities/ — 2026-07-16
• SecurityWeek — "F5 Patches Critical, High-Severity NGINX Vulnerabilities" — https://www.securityweek.com/f5-patches-critical-high-severity-nginx-vulnerabilities/ — 2026-07-16
• BleepingComputer — "F5 issues out-of-band patches for critical NGINX vulnerabilities" — https://www.bleepingcomputer.com/news/security/f5-issues-out-of-band-patches-for-critical-nginx-vulnerabilities/ — 2026-07-16
• BSI Germany — "WID-SEC-2026-1995: NGINX und NGINX Plus: Mehrere Schwachstellen" — https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1995 — 2026-07-16
• BSI Germany — "WID-SEC-2026-2383: NGINX NGINX Plus: Mehrere Schwachstellen" — https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2383 — 2026-07-16

8. Adverse Trace position

Severity: Critical. CVE-2026-42533 (CVSS 9.2) is an unauthenticated, remote heap buffer overflow in NGINX — a ubiquitous component in EMEA financial services infrastructure. While exploitation depends on specific map directive configuration patterns and code execution requires ASLR to be disabled, the crash/restart DoS impact is achievable on any vulnerable configuration. The absence of confirmed in-the-wild exploitation (per F5) provides a window for proactive patching, but the out-of-band nature of the release signals F5's assessment of urgency. Clients should prioritise internet-facing NGINX/NGINX Plus instances with complex configurations (API gateways, reverse proxies) and BIG-IP virtual servers with HTTP/2 profiles. Confidence caveat: All CVSS scores, severity ratings, and technical details are single-sourced from F5's advisory via SecurityWeek reporting; no verified CVE reference data was available for cross-validation. Adverse Trace will monitor for CISA KEV addition, proof-of-concept publication, and any exploitation reporting, and will issue an update if the threat landscape changes.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.