Vulnerability

CERT-In Vulnerability Note CIVN-2026-0239
Multiple Vulnerabilities in NGINX Products

Original Issue Date:May 16, 2026

Severity Rating: CRITICAL

Software Affected

NGINX Open-Source versions 0.3.50 through 1.30.0
NGINX Plus R32 through R36
NGINX Instance Manager 2.16.0 through 2.22.0
F5 WAF for NGINX 5.9.0 through 5.12.1
NGINX App Protect WAF 4.9.0 through 4.16.0 and 5.1.0 through 5.8.0
F5 DoS for NGINX 4.8.0
NGINX App Protect DoS 4.3.0 through 4.7.0
NGINX Gateway Fabric 1.3.0 through 1.6.2 and 2.0.0 through 2.6.0
NGINX Ingress Controller 3.5.0 through 3.7.2, 4.0.0 through 4.0.1, and 5.0.0 through 5.4.2

Overview

Multiple vulnerabilities have been reported in NGINX products, which could allow an attacker to execute unauthorized commands, access sensitive information, or cause a denial-of-service condition on the targeted system.

Target Audience:
All organizations and individuals using affected versions of NGINX products.

Risk Assessment:
Risk of remote code execution, information disclosure, unauthorized access, and denial of service.

Impact Assessment:
Potential for information disclosure, memory corruption, unauthorized operations, remote code execution, and service disruption.

Description

NGINX Plus and NGINX Open Source are widely used web server and reverse proxy solutions designed to support high-performance web applications and enterprise services.

1. Heap Buffer Overflow Vulnerability ( CVE-2026-42945   )

A vulnerability in ngx_http_rewrite_module due to improper handling of unnamed PCRE captures with certain rewrite conditions may lead to a heap buffer overflow, causing worker process restart and potential code execution when ASLR is disabled.

2. Information Disclosure Vulnerability ( CVE-2026-42946   )

A vulnerability in ngx_http_scgi_module and ngx_http_uwsgi_module due to improper validation of upstream responses may allow an attacker with MITM capability to trigger excessive memory allocation or buffer over-read, leading to information disclosure or worker process restart.

3. Heap Buffer Over-Read Vulnerability ( CVE-2026-42934   )

A vulnerability in ngx_http_charset_module due to improper memory handling under specific charset and proxy configurations may result in a heap buffer over-read, leading to limited memory disclosure or worker process restart.

4. Heap-Use-After-Free Vulnerability ( CVE-2026-40701   )

A vulnerability in ngx_http_ssl_module due to improper memory handling under specific SSL client verification and OCSP configurations may result in a heap use-after-free condition, leading to limited data modification or worker process restart.

Solution

Apply appropriate updates as mentioned by the vendor:
https://my.f5.com/manage/s/article/K000161019

https://my.f5.com/manage/s/article/K000161027

https://my.f5.com/manage/s/article/K000161028

https://my.f5.com/manage/s/article/K000161021

Vendor Information

NGINX
https://my.f5.com/manage/s/article/K000161019
https://my.f5.com/manage/s/article/K000161027
https://my.f5.com/manage/s/article/K000161028
https://my.f5.com/manage/s/article/K000161021

References

https://my.f5.com/manage/s/article/K000161019
https://my.f5.com/manage/s/article/K000161027
https://my.f5.com/manage/s/article/K000161028
https://my.f5.com/manage/s/article/K000161021
https://www.bleepingcomputer.com/news/security/18-year-old-nginx-vulnerability-allows-dos-potential-rce/

CVE Name
CVE-2026-42945
CVE-2026-42946
CVE-2026-42934
CVE-2026-40701

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India