Skip to main content
The Website Services team at NHS England are testing early designs to understand how you find information. Your views will help us check our ideas work. Sign up to take part in our user research.

F5 Releases Security Updates for NGINX Vulnerability CVE-2026-42945

NGINX Plus and NGINX Open Source have a vulnerability that could force a restart or allow code execution if exploited

Threat ID:
CC-4783
Threat Severity:
Medium
Published:
14 May 2026 3:16 PM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

NGINX Plus and NGINX Open Source have a vulnerability that could force a restart or allow code execution if exploited

Affected platforms

The following platforms are known to be affected:

F5 NGINX

Versions affected with updates available

  • NGINX Plus - Rx
  • NGINX Open Source - 1.x

The following platforms are also known to be affected:

  • NGINX Instance Manager - 2.x
  • F5 WAF for NGINX - 5.x
  • NGINX App Protect WAF - 5.x
  • F5 DoS for NGINX - 4.x
  • NGINX App Protect DoS - 4.x
  • NGINX Gateway Fabric - 2.x and 1.x
  • NGINX Ingress Controller - 5.x, 4.x, and 3.x

F5 also list the following version as being affected but it will not have a fixed version released:

  • NGINX Open Source - 0.x

Note: Other software versions which have reached End of Technical Support (EoTS) are not evaluated.

Note: Products from other vendors that include the base NGINX Plus or NGINX Open Source software components may also be affected

Threat details

Exploitation of CVE-2026-42945

Security researchers have reported exploitation of CVE-2026-42945 in the wild. Additionally, a proof-of-concept exploit has been released for the vulnerability CVE-2026-42945. The NHS England National CSOC assesses further exploitation as highly likely.

Introduction

F5 has released a security advisory for a vulnerability for F5 NGINX products, including NGINX Plus (branch Rx) and NGINX Open Source (branch 1.x). 

Successful exploitation by an unauthenticated, remote attacker could cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, for systems with Address Space Layout Randomisation (ASLR) disabled, code execution is possible.

  • CVE-2026-42945 - Heap-based Buffer Overflow vulnerability with a CVSSv4 base score of 9.2

Threat updates

Date Update
18 May 2026 Exploitation of CVE-2026-42897 reported in the wild

Remediation advice

Affected organisations are strongly encouraged to review F5's security advisory K000161019: NGINX ngx_http_rewrite_module vulnerability CVE-2026-42945 and apply any relevant updates or mitigation.

Definitive source of threat updates

Last edited: 18 May 2026 11:43 am