F5 Nginx Gateway Fabric vulnerabilities

CVE-2026-42945 [HIGH] CWE-122 CVE-2026-42945: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vu NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthent

CVE-2026-9256 [HIGH] CWE-122 CVE-2026-9256: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vu NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for example, ^/((.*))$) and a replacement string that references multiple such captures (for example, $1$2) in

CVE-2026-42055 [HIGH] CWE-122 CVE-2026-42055: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_g NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability exists when the proxy_http_version to 2 or grpc_pass directives are used to proxy HTTP/2 traffic, the ignore_invalid_headers directive is set to off, and the large_client_header_buffers directive size is larger tha

CVE-2026-42530 [HIGH] CWE-416 CVE-2026-42530: NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open Source is co NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, a remote unauthenticated attacker along with conditions beyond their control can use a specially crafted HTTP/3 session to reopen a QPACK encoder stream. This may cause a Use-after-Free in the NGINX worker process

CVE-2026-91184 [HIGH] CWE-76 CVE-2026-91184: Description NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm (and spec Description NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm (and spec.jwt.realm) field of a namespaced AuthenticationFilter verbatim, unescaped and unvalidated, into the shared data-plane nginx.conf as auth_basic "";. A namespaced authenticated attacker that configures AuthenticationFilter CRD to an HTTPRoute/GRPCRoute on

CVE-2026-66362 [HIGH] CWE-76 CVE-2026-66362: Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the Authentication Filter Custom Resource Definition clientID or cookieName fields, or in the clientSecret field of a Secret refe

CVE-2026-50107 [HIGH] CWE-74 CVE-2026-50107: When NGINX Plus or NGINX Open Source is configured as the data plane for NGINX Gateway Fabric, an in When NGINX Plus or NGINX Open Source is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the NginxProxy Custom Resource Definition (CRD) access log format setting are rendered directly into NGINX configuration

CVE-2026-42533 [HIGH] CWE-122 CVE-2026-42533: A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauth

CVE-2026-60005 [HIGH] CWE-908 CVE-2026-60005: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX worker process, leading to limited disclosure of memo

CVE-2026-42946 [HIGH] CWE-789 CVE-2026-42946: A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data. When scgi_pass or uwsgi_pass is configured, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to read the memory of the NGI

CVE-2026-11311 [MEDIUM] CWE-76 CVE-2026-11311: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the NginxProxy Custom Resource Definition serverTokens field and the AuthenticationFilter Custom Resource Definition extraAuthArgs field ar

CVE-2026-56434 [MEDIUM] CWE-416 CVE-2026-56434: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module. This vulner NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module. This vulnerability may exist when the Server-Side Includes (SSI), proxy_pass, and proxy_buffering off directives are configured. With this configuration, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream serv

CVE-2026-96615 [MEDIUM] CWE-290 CVE-2026-96615: Description NGINX Gateway Fabric has a vulnerability when it is configured with Gateway Custom Res Description NGINX Gateway Fabric has a vulnerability when it is configured with Gateway Custom Resource Definition (CRD) and have an authenticated gRPC connection with NGINX Agent. A namespaced authenticated attacker with access to a service account may impersonate the authenticated NGINX Agent gRPC connection to read TLS private keys of Gateway dep

CVE-2026-40460 [MEDIUM] CWE-290 CVE-2026-40460: When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may b When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-32682 [MEDIUM] CWE-129 CVE-2026-32682: When NGINX Gateway Fabric is configured using GRPCRoutes, an authenticated, remote attacker with per When NGINX Gateway Fabric is configured using GRPCRoutes, an authenticated, remote attacker with permission to create or modify GRPCRoute resources can cause the NGINX Gateway Fabric control plane to terminate by sending undisclosed GRPCRoute configurations containing backendRef filters. Note: Software versions which have reached End of Technical

CVE-2026-1642 [MEDIUM] CWE-349 CVE-2026-1642: A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport La A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response from an upstream proxied server. Not

CVE-2026-60065 [MEDIUM] CWE-125 CVE-2026-60065: When NGINX Plus is configured to use the Message Queuing Telemetry Transport (MQTT) filter module (n When NGINX Plus is configured to use the Message Queuing Telemetry Transport (MQTT) filter module (ngx_stream_mqtt_filter_module), unauthenticated attackers can send requests with conditions beyond the attacker's control to cause a heap buffer over-read in the NGINX worker process, leading to a restart. Impact: This vulnerability may allow remote u

CVE-2026-42926 [MEDIUM] CWE-172 CVE-2026-42926: When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also uses proxy_set_body, an attacker may be able to inject frame headers and payload bytes to the upstream peer. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-42934 [MEDIUM] CWE-125 CVE-2026-42934: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When ch NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map and proxy_pass with disabled buffering ("off") directives are configured, unauthenticated attackers can send requests that with conditions beyond the attackers' control to cause a heap buffer over-read in the NGI

CVE-2026-48142 [MEDIUM] CWE-125 CVE-2026-48142: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When co NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When content is served or proxied through a location block with both source_charset utf-8; and a charset directive (for example, charset koi8-r;) configured, remote, unauthenticated attackers can send requests (in conjunction with conditions beyond their con