F5 has released fixes for a critical vulnerability in nginx that allows a remote, unauthenticated attacker to trigger a heap buffer overflow in the worker process simply by sending specially crafted HTTP requests.

The flaw, tracked as CVE-2026-42533, was patched on July 15 in the following releases:

  • nginx 1.30.4 (stable branch)
  • nginx 1.31.3 (mainline branch)
  • NGINX Plus 37.0.3.1

Organizations running any earlier build are urged to upgrade immediately.

Impact

Successfully triggering the bug can crash or restart the affected worker process, resulting in a denial of service. Given that the underlying issue is a heap buffer overflow reachable via unauthenticated network requests, the vulnerability class carries the potential for remote code execution beyond a simple crash, though the primary confirmed impact at this time is worker process disruption.

Because nginx sits at the front of an enormous share of internet-facing infrastructure, from reverse proxies and load balancers to API gateways, a flaw that can be triggered pre-authentication and remotely is significant. Repeated crafted requests could be used to repeatedly crash worker processes, degrading availability across affected services.

Recommendations

Security teams should treat this as a priority patching item:

  • Identify all nginx and NGINX Plus deployments across the environment, including embedded instances in appliances or containers
  • Upgrade to nginx 1.30.4 (stable), 1.31.3 (mainline), or NGINX Plus 37.0.3.1 as appropriate
  • Monitor for unexpected worker process restarts or crashes, which may indicate exploitation attempts
  • Review logs for anomalous or malformed HTTP requests targeting nginx-fronted services

Given nginx’s ubiquity as reverse proxy and web server software, organizations should prioritize this update across all customer-facing and internal deployments.