F5 News Articles

NGINX Map Regex RCE Gets Public Scanner: Patch Now, Full Exploit Due August

CVE-2026-42533 NGINX vulnerability now has a public config scanner as researcher Stan Shaw warns the critical heap buffer overflow — present in all NGINX versions since 2011 — defeats ASLR on its own

2 days ago

15-Year-Old NGINX Vulnerability Lets Attackers Crash Workers and Achieve Remote Code Execution - IT Security News

A newly disclosed flaw tracked as CVE-2026-42533 affects nginx’s script engine and has been silently exploitable since March 2011, when the map directive gained regex support. Security researcher Stan Shaw reported the bug to F5 SIRT, which coordinated a fix…Read more →

2 days ago

15-Year-Old NGINX Vulnerability Lets Attackers Crash Workers and Achieve Remote Code Execution

A newly disclosed flaw tracked as CVE-2026-42533 affects nginx's script engine and has been silently exploitable since March 2011, when the map directive gained regex support.

2 days ago

Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution

F5 has shipped fixes for a critical nginx flaw that lets a remote, unauthenticated attacker trigger a heap buffer overflow in the worker process with crafted

2 days ago

Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution - IT Security News

F5 has shipped fixes for a critical nginx flaw that lets a remote, unauthenticated attacker trigger a heap buffer overflow in the worker process with crafted HTTP requests. CVE-2026-42533 was patched on July 15 in nginx 1.30.4 (stable) and 1.31.3…Read more →

2 days ago

Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution

F5 patches CVE-2026-42533, a regex map heap overflow that crashes nginx workers and may allow RCE in specific configurations.

3 days ago

NGINX Vulnerability Patch: F5 Fixes Critical HTTP/3 and HTTP/2 Remote Code Execution Flaws

NGINX vulnerability patch is now critical: F5’s June 2026 out-of-band advisory covers two unauthenticated CVSS 9.2 flaws in HTTP/3 QUIC and HTTP/2 gRPC modules that can crash workers or enable remote

The ASLR Caveat on NGINX’s Critical HTTP/3 Flaw Changes Nothing About Urgency - IT Security News

CVE-2026-42530, the NGINX HTTP/3 vulnerability rated CVSS 9.2, is collecting dismissals because exploitation requires ASLR to be disabled or bypassed. Here is why that framing is wrong and why patching cannot wait. The ASLR Caveat on NGINX’s Critical HTTP/3 Flaw…Read more →

NGINX HTTP/3 Vulnerability: Why ASLR Won't Save You

The NGINX HTTP/3 vulnerability CVE-2026-42530 is 9.2 for good reason. Relying on ASLR to mitigate it ignores how real attacks work. Patch now.

F5 Patches Two Critical NGINX Open Source Flaws Enabling Remote Code Execution

F5 fixes CVE-2026-42530 and CVE-2026-42055 in NGINX Open Source, addressing HTTP/3 and HTTP/2 flaws that could allow remote code execution.

Critical flaw in software powering a third of the internet is already being exploited – free checker now available - IT Security News

A critical security vulnerability in NGINX, the web server software underpinning more than 30% of all websites globally, has been confirmed as actively exploited in the wild, less than a week after its public disclosure. The flaw, tracked as CVE-2026-42945…Read more →

Hackers Actively Exploit ‘Nginx Rift’ Vulnerability Affecting NGINX, F5 Products

Hackers are actively exploiting the Nginx Rift vulnerability affecting NGINX and F5 products, exposing servers to denial-of-service attacks.

CVE-2026-42945: Mitigating a Critical Heap Buffer Overflow Vulnerability in NGINX - IT Security News

Discover CVE-2026-42945 (NGINX Rift), a critical heap buffer overflow vulnerability. Learn about the affected versions and critical patch updates. This article has been indexed from Blog Read the original article: CVE-2026-42945: Mitigating a Critical Heap Buffer Overflow Vulnerability in NGINXRead ...

Hackers Actively Exploiting Critical NGINX RCE Vulnerability in the Wild - IT Security News

Hackers are wasting no time exploiting a newly disclosed critical vulnerability in NGINX, with security researchers already observing real-world attacks just days after its public release. Security researcher Patrick Garrity from VulnCheck revealed that threat actors are actively targeting CVE-2026-...

Attackers are exploiting critical NGINX vulnerability (CVE-2026-42945) - IT Security News

A critical NGINX vulnerability (CVE-2026-42945) disclosed last week is being exploited by attackers, VulnCheck security researcher Patrick Garrity revealed on Saturday. The vulnerability, dubbed NGINX Rift, can be reliably exploited to trigger a denial-of-service condition and can potentially allow ...

Attackers are exploiting critical NGINX vulnerability (CVE-2026-42945) - Help Net Security

A critical NGINX vulnerability (CVE-2026-42945) that was disclosed last week is being exploited by attackers, according to VulnCheck.

NGINX Rift attackers waste no time targeting exposed servers

Researchers say 18-year-old flaw already being probed and exploited just days after disclosure

NGINX Rift attackers waste no time targeting exposed servers

Researchers say 18-year-old flaw already being probed and exploited just days after disclosure

Experts warn of active exploitation of critical NGINX flaw CVE-2026-42945 - IT Security News

A critical NGINX flaw (CVE-2026-42945) is actively exploited, allowing crashes or possible code execution via malicious HTTP requests. A critical vulnerability in NGINX Plus and NGINX Open, tracked as CVE-2026-42945 (CVSS v4 score of 9.2), is already being actively exploited…Read more →

Exploitation of Critical NGINX Vulnerability Begins

Threat actors are exploiting CVE-2026-42945, a critical NGINX vulnerability that leads to remote code execution if ASLR is disabled.

NGINX CVE-2026-42945 Exploited in the Wild, Causing Worker Crashes and Possible RCE

Ravie LakshmananMay 17, 2026Server Security / Vulnerability

NGINX CVE-2026-42945 Exploited in the Wild, Causing Worker Crashes and Possible RCE - IT Security News

A newly disclosed security flaw impacting NGINX Plus and NGINX Open has come under active exploitation in the wild, days after its public disclosure, according to VulnCheck. The vulnerability, tracked as CVE-2026-42945 (CVSS score: 9.2), is a heap buffer overflow…Read more →

NGINX CVE-2026-42945 Exploited in the Wild, Causing Worker Crashes and Possible RCE

CVE-2026-42945 is exploited after disclosure, impacting NGINX 0.6.27–1.30.0 and enabling crashes or RCE.

CVE-2026-42945: Imperva Customers Protected Against Critical NGINX Rewrite Module Vulnerability - IT Security News

TL;DR: Researchers recently disclosed CVE-2026-42945, a critical heap-based buffer overflow vulnerability affecting both NGINX Open Source and NGINX Plus. The flaw exists within the ngx_http_rewrite_module component and can allow unauthenticated attackers to trigger denial-of-service conditions and ...

18-year-old NGINX vulnerability allows DoS, potential RCE

An 18-year-old flaw in the NGINX open-source web server, discovered using an autonomous scanning system, can be exploited for denial of service and, under certain conditions, remote code execution.