🔴 Critical | Source: The Hacker News
A critical heap buffer overflow vulnerability in NGINX (CVE-2026-42533) allows an unauthenticated remote attacker to crash worker processes or potentially execute arbitrary code by sending crafted HTTP requests. F5 patched the flaw on 15 July 2026 in NGINX stable (1.30.4), mainline (1.31.3), and NGINX Plus (37.0.3.1). Given NGINX’s ubiquity as a web server and reverse proxy across cloud-hosted infrastructure, the blast radius is significant.
Security Architect’s Take: Prioritise upgrading all NGINX and NGINX Plus instances to the patched versions immediately — this is particularly urgent for internet-facing deployments acting as ingress controllers, API gateways, or load balancers. If immediate patching is not possible, consider placing a WAF or rate-limiting layer in front of affected instances and monitoring for anomalous HTTP request patterns while an emergency change is scheduled.
Original advisory: Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution