F5 Patches Two Critical NGINX Open Source Flaws Enabling Remote Code Execution

F5 has released security updates to address two critical security flaws in NGINX Open Source that could be exploited to achieve code execution on affected systems. The vulnerabilities are listed below - CVE-2026-42530 (CVSS v4 score: 9.2) - A use-after-free vulnerability in the ngx_http_v3_module that could be triggered by a remote unauthenticated attacker when NGINX Open Source is

The report says F5 released security updates for two critical NGINX Open Source vulnerabilities, including CVE-2026-42530 in the ngx_http_v3_module, which can be triggered remotely and may lead to code execution on affected systems. NGINX’s advisory lists versions 1.31.0-1.31.1 as vulnerable and 1.31.2+ as not vulnerable, with the issue reachable when HTTP/3 QUIC is enabled.[6] CyberSE.AI analysis: this is primarily an AI supply chain concern because widely used infrastructure software is affected and downstream services may inherit exposure if they bundle or depend on vulnerable NGINX builds; organizations should inventory dependencies, confirm patch levels, and validate whether HTTP/3 is enabled in production.