F5 Fixes 3 NGINX Flaws Enabling Potential Remote Code Execution, Memory Disclosure, and DoS Attacks

F5 has issued security advisories for three vulnerabilities affecting NGINX Plus and NGINX Open Source. These flaws could allow unauthenticated attackers to trigger crashes in worker processes, disclose limited memory contents, or potentially execute code under specific conditions.

The vulnerabilities, identified as CVE-2026-56434, CVE-2026-42533, and CVE-2026-60005, impact the data-plane request processing of NGINX rather than its control plane.

F5 Fixes 3 NGINX Flaws

Exploitation typically depends on specific module-configuration combinations, so organizations with affected deployments should review their configurations and promptly apply the updates provided by F5.

• CVE-2026-56434 (K000162098): A use-after-free flaw in ngx_http_ssi_module that can cause limited memory modification or restart an NGINX worker process.
• CVE-2026-42533 (K000162097): A heap buffer overflow involving the map directive and regex captures that can lead to denial of service or possible code execution.
• CVE-2026-60005 (K000162100): An uninitialized-memory access flaw in ngx_http_slice_module that may disclose limited process memory or restart workers.

The most critical issue is CVE-2026-42533, which arises from how NGINX handles configuration via regex matching in the map directive.

This vulnerability occurs when a string expression references regex capture variables associated with a map before the map output variable. F5 noted that a similar condition may occur when a non-cacheable variable is used in a string expression under certain circumstances.

An unauthenticated remote attacker can send specially crafted HTTP requests to exploit the heap buffer overflow in an NGINX worker process.

Successful exploitation can lead to a worker crash, resulting in a denial-of-service condition. F5 also cautioned that code execution may be possible in scenarios where Address Space Layout Randomization (ASLR) is disabled or if an attacker can bypass ASLR protections.

This situation stresses the importance of reviewing complex NGINX map configurations that depend on regex captures and dynamic variables.

CVE-2026-56434 affects deployments with the Server-Side Includes (SSI) module enabled and configured alongside `proxy_pass` and with `proxy_buffering` turned off.

An attacker must have a man-in-the-middle position that can control the responses sent by an upstream server. Under these conditions, malicious upstream content can trigger a use-after-free condition in the NGINX worker process.

F5 categorized CVE-2026-56434 as CWE-416 (use-after-free). Exploitation of this flaw may allow limited modification of memory contents or force a restart of the worker process.

Although the requirement for upstream response control reduces the likelihood of opportunistic exploitation across the Internet, organizations should take this vulnerability seriously, especially if NGINX is proxying traffic to externally controlled, compromised, or insufficiently trusted upstream services.

The third issue, CVE-2026-60005, affects the optional ngx_http_slice_module. This bug can be triggered when the slice directive is configured with unnamed regex captures or when a background cache update occurs.

Maliciously crafted requests may cause uninitialized memory access, potentially exposing limited memory contents from the NGINX worker process or causing a restart.

F5 classified CVE-2026-60005 as CWE-908 (use of an uninitialized resource). The ngx_http_slice_module is not enabled by default and requires compilation with the `–with-http_slice_module` parameter, narrowing the affected attack surface.

Affected products include NGINX Plus and NGINX Open Source deployments that utilize the vulnerable modules or configuration patterns. Administrators are advised to consult F5 advisories K000162098, K000162097, and K000162100 for version-specific fixed releases, upgrade affected instances, and audit their map, SSI, proxy buffering, and slice-module settings.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.