F5 issues security updates for critical vulnerabilities in NGINX Open Source, including flaws that security researchers say could be exploited by remote, unauthenticated attackers. Multiple reports describe the updates as out-of-band, released ahead of a scheduled maintenance window, to address urgent risk.
One of the addressed issues is identified as CVE-2026-42530, reported with a CVSS v4 score of 9.2. Security information provided in coverage indicates it is a use-after-free vulnerability in the ngx_http_v3_module that can be triggered remotely without authentication. Other coverage also refers to two critical-severity issues capable of enabling remote code execution on affected systems.
In addition to the code execution risk, one outlet reports that the vulnerabilities could allow an attacker to cause a restart of the NGINX service. Collectively, the reporting indicates F5’s patches are intended to remediate the affected components and reduce exposure for deployments running vulnerable versions of NGINX Open Source. Users are advised to apply the released updates promptly and follow F5 guidance regarding affected versions and upgrade steps.
