F5 NGINX CVE-2026-42530 / CVE-2026-42055 — Critical Unauthenticated RCE

On approximately 17–18 June 2026, F5 issued out-of-band patches for two critical (CVSS v4 9.2) NGINX vulnerabilities, both exploitable by a remote, unauthenticated attacker against the HTTP request path:

• CVE-2026-42530 — use-after-free in ngx_http_v3_module. When NGINX is configured with the HTTP/3 / QUIC module, a specially crafted HTTP/3 session that reopens a QPACK encoder stream triggers a UAF in the NGINX worker. The reliable outcome is a repeated worker crash (DoS); arbitrary code execution is possible on systems where ASLR is disabled or can be bypassed.
• CVE-2026-42055 — heap-based buffer overflow in ngx_http_proxy_v2_module and ngx_http_grpc_module. Triggered when NGINX proxies HTTP/2 upstream (proxy_http_version 2 or grpc_pass) with ignore_invalid_headers off and large_client_header_buffers sized above 2 MB. Heap corruption again yields DoS and potential code execution under the same ASLR caveat.

Affected products span NGINX Open Source, NGINX Plus, NGINX Gateway Fabric, NGINX Ingress Controller, NGINX Instance Manager, and the NGINX App Protect / F5 WAF & DoS lines. Fixed builds: NGINX OSS 1.31.2 and 1.30.3, NGINX Gateway Fabric 2.6.4, NGINX Plus R36 P6 / 37.0.2.1. F5 advisories: K000161616 (CVE-2026-42530) and K000161584 (CVE-2026-42055).

As of publication, there is no public proof-of-concept and no confirmed in-the-wild exploitation. F5 / NGINX appliances have, however, a strong history of rapid weaponization, so the window is short. This pack hunts endpoints (Linux hosts and containers) that run Falcon. The memory corruption itself happens in-process inside the NGINX worker and is largely invisible to EDR, so the durable, high-fidelity signal is what the worker does next: an nginx worker spawning a shell / interpreter / download tool, a new ELF written under a web root, an unexpected listener post-exploit, or beaconing to new infrastructure. The pack pairs those behavioral hunts with a vulnerable-version inventory hunt — the patch is the fix.

Decisions: No atomic IOCs (hashes / domains / IPs), no public PoC, and no confirmed in-the-wild exploitation were published, so the pack is behavior-keyed, not IOC-keyed — anchor on NGINX-worker-parented anomalous execution, ELF/webshell writes under web roots, unexpected post-exploit listeners, and rare egress, plus a worker-crash-loop proxy for exploitation attempts. Lead with the patch (the fix) and a version-inventory hunt. The QUIC/QPACK and HTTP/2 heap primitives are in-process inside the worker and invisible to EDR by design, so we hunt the consequences of a successful chain on the endpoint. Scope is Linux hosts and containers running NGINX (OSS/Plus/Gateway Fabric/Ingress/App Protect).

Working hypothesis: An unauthenticated attacker reaches an internet- or internally-exposed NGINX listener and sends a crafted request. For CVE-2026-42530 that is an HTTP/3 (QUIC) session that reopens a QPACK encoder stream, corrupting freed memory in the worker; for CVE-2026-42055 it is oversized/invalid HTTP/2 headers proxied upstream that overflow a heap buffer. The reliable result is a worker crash → master respawn loop (DoS). Where ASLR is disabled or bypassed, the attacker pivots the corruption into code execution inside the NGINX worker and then lands post-exploitation tooling on the host. EDR telemetry begins where the worker interacts with the OS — child processes, file writes, new listeners, and network egress.

Hunt hypotheses (fidelity-ordered)

• H1 (high): An nginx worker directly spawns an interactive shell or interpreter → Q1. Near-zero benign baseline.
• H2 (high): An nginx worker spawns a download / recon tool (curl, wget, id, whoami, uname) → Q2. Workers serve content; they do not run recon.
• H3 (high): An nginx worker writes an ELF / script under a web root or tmp path then it executes → Q3 (webshell / dropped payload).
• H4 (high): A new network listener appears on an NGINX host whose owning process is not nginx → Q4 (bind shell / tunnel).
• H5 (medium): An nginx worker makes an outbound connection to newly-seen / rare external infrastructure → Q5 (reverse shell / C2).
• H6 (medium): Repeated short-lived nginx worker respawns on a host in a tight window → Q6 (crash-loop = exploitation attempt, success or failure / DoS).
• H7 (high): Hosts still running an NGINX build below the fixed version → Q7 (inventory hunt; patch is the fix).

Grouped IOC Quick-Copy

No atomic IOCs were published — these are behavioral hunt artifacts, a version/patch audit (the fix), and the config-mitigation set, NOT threat-intel atomics. Use the CSV with REPLACE_WITH_ placeholders only if your IR turns up campaign atomics.

type,value,action,severity,expiration,description,tags
sha256,REPLACE_WITH_PAYLOAD_SHA256,prevent,critical,2027-06-19,CVE-2026-42530/-42055 nginx-dropped payload,campaign:F5-NGINX-RCE
domain,REPLACE_WITH_C2_DOMAIN,detect,high,2026-09-19,CVE-2026-42530/-42055 post-exploit C2,campaign:F5-NGINX-RCE
ipv4,REPLACE_WITH_C2_IP,detect,high,2026-09-19,CVE-2026-42530/-42055 post-exploit C2,campaign:F5-NGINX-RCE

nginx worker spawns sh/bash/dash/zsh/python/perl/ruby/php/php-cgi/lua
nginx worker spawns curl/wget/nc/ncat/socat/id/whoami/uname/hostname/crontab/chmod/base64
nginx worker writes an ELF/script under a web root, uploads dir, or /tmp /dev/shm /var/tmp then it executes
New non-nginx listener (sh/bash/python/nc/socat) on a host that also runs nginx
nginx process makes an outbound connection to rare/newly-seen external infrastructure
nginx worker crash/respawn storm on a single host in a tight window (UAF/heap crash loop = exploit attempt or DoS)

# Fixed builds (CVE-2026-42530 / CVE-2026-42055):
#   NGINX Open Source 1.31.2  (and 1.30.x line: 1.30.3)
#   NGINX Gateway Fabric 2.6.4
#   NGINX Plus R36 P6 / 37.0.2.1
# Check installed version (Linux):
nginx -v            # prints: nginx version: nginx/1.31.x
dpkg -l | grep -i nginx        # Debian/Ubuntu
rpm -q nginx                   # RHEL/CentOS/Rocky
# Vulnerable if < 1.31.2 (or 1.30.x < 1.30.3) for OSS; < 2.6.4 for NGF; < R36 P6 for Plus
# Patch via package manager / Helm chart / container image bump, then reload: nginx -s reload

CVE-2026-42530   # UAF in ngx_http_v3_module (HTTP/3 QUIC, QPACK encoder reopen) - CVSS v4 9.2 - F5 K000161616
CVE-2026-42055   # heap overflow in ngx_http_proxy_v2_module + ngx_http_grpc_module - CVSS v4 9.2 - F5 K000161584
CVE-2026-11311   # NGF config injection (authenticated, high) - patched same release
CVE-2026-50107   # NGF config injection (authenticated, high) - patched same release
# Interim mitigations if you cannot patch immediately:
#  -42530: disable HTTP/3 — remove the 'quic' parameter from all 'listen' directives (and reuseport/http3 on)
#  -42055: remove 'ignore_invalid_headers off;' AND/OR set large_client_header_buffers below 2 MB
# Keep ASLR enabled (kernel.randomize_va_space=2) - RCE requires ASLR disabled or bypassed
# Defense-in-depth: terminate untrusted HTTP/3 at a patched edge; restrict who can reach NGINX listeners

This is patchable — updating NGINX is the fix. The config mitigations below remove the trigger conditions for hosts that cannot patch immediately; everything else is defense-in-depth against web-server-exploit chains generally. Platforms touched: Linux hosts and containers, NGINX config, Kubernetes (NGF / Ingress), and the perimeter (LB / WAF).

Playbook A · Report installed NGINX version & flag vulnerable hosts (Linux, shell)

# 1. Print the running NGINX version
nginx -v 2>&1            # nginx version: nginx/1.31.x
dpkg -l | grep -i '^ii.*nginx' 2>/dev/null || rpm -q nginx 2>/dev/null

# 2. Flag vulnerable: OSS < 1.31.2 (or 1.30.x < 1.30.3)
ver=$(nginx -v 2>&1 | sed -E 's#.*nginx/([0-9.]+).*#\1#')
maj=${ver%%.*}; rest=${ver#*.}; min=${rest%%.*}; patch=${rest#*.}
if [ "$maj" -eq 1 ] && { [ "$min" -lt 30 ] \
   || { [ "$min" -eq 30 ] && [ "$patch" -lt 3 ]; } \
   || { [ "$min" -eq 31 ] && [ "$patch" -lt 2 ]; }; }; then
  echo "VULNERABLE: nginx $ver -- patch to 1.31.2 / 1.30.3"
else
  echo "OK: nginx $ver"
fi

Playbook B · Apply interim config mitigations (nginx.conf) — only if you cannot patch yet

# CVE-2026-42530 (HTTP/3 UAF): disable HTTP/3 / QUIC.
#   In each server{} block, remove the 'quic' parameter and any 'http3 on;':
#     - listen 443 quic reuseport;   # <-- REMOVE this listener (or drop 'quic')
#       listen 443 ssl;              # keep TLS over TCP only
#     - http3 on;                    # <-- REMOVE

# CVE-2026-42055 (HTTP/2 proxy/gRPC heap overflow): remove the trigger conditions.
#       ignore_invalid_headers off;       # <-- REMOVE (default is 'on')
#       large_client_header_buffers 4 8k; # keep buffer size well below 2 MB

# Validate & reload:
nginx -t && nginx -s reload
# Confirm no quic listeners remain:
nginx -T 2>/dev/null | grep -E 'listen .*quic|http3 on|ignore_invalid_headers off'

Playbook C · Confirm ASLR is enabled (Linux) — RCE requires it disabled/bypassed

# Read current ASLR setting (2 = full randomization, the secure default):
sysctl kernel.randomize_va_space        # expect: kernel.randomize_va_space = 2
# If not 2, enable persistently:
echo 'kernel.randomize_va_space = 2' > /etc/sysctl.d/99-aslr.conf
sysctl --system
# Harden the unit so worker RCE has minimal reach (systemd drop-in):
#   [Service]
#   NoNewPrivileges=yes
#   ProtectSystem=strict
#   ReadOnlyPaths=/usr/share/nginx/html

Validation gates: (1) confirm Linux ProcessRollup2 retains ParentBaseFileName + ElfFileWritten/NetworkListenIP4 context fleet-wide; (2) Q1/Q2 return zero hits in a 30-day benign lookback after FastCGI/health-check exclusions; (3) inventory NGINX versions (Q7/N1) and confirm the fixed build; (4) lab-validate lineage firing with a benign nginx-parent harness — never the live exploit; (5) promote Q1 to Custom IOA Detect+Block (target FP < 1/week). The in-worker UAF/heap step is an accepted detection gap — mitigated by the patch, config mitigations, ASLR, and the crash-storm proxy (Q6).

HuntPack v0.1 · F5 NGINX CVE-2026-42530 / CVE-2026-42055 (critical unauthenticated RCE) · Generated 2026-06-19 · Defensive use only — no exploit code. The patch (NGINX ≥ 1.31.2 / 1.30.3, NGF 2.6.4, Plus R36 P6 / 37.0.2.1) is the fix; config mitigations (disable HTTP/3, fix header handling) close the trigger conditions; behavioral hunts cover the post-exploitation chain and are durable defense-in-depth for web-server-exploit follow-on. No atomic IOCs, PoC, or confirmed in-the-wild exploitation were published as of generation; validate field names (especially the Q7 version feed) in your tenant before promoting any query to alerting.