NGINX flaws enable RCE across major versions
Multiple vulnerabilities in NGINX Open Source, NGINX Plus, and NGINX Gateway Fabric allow remote code execution, denial of service, and data confidentiality breaches.
Sourcecert.ssi.gouv.fr — open the original
What to check
- Applies to
- The 3 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT-FR has published an advisory detailing multiple security vulnerabilities affecting widely-deployed NGINX products. The flaws impact NGINX Open Source versions 1.30.x and 1.31.x, NGINX Plus versions R33 through R37, and NGINX Gateway Fabric versions 1.3.0 through 2.6.3. The vulnerabilities enable attackers to execute arbitrary code remotely, trigger denial-of-service conditions, compromise data confidentiality, and compromise data integrity.
F5 and NGINX have released patches to address the issues, identified as CVE-2026-42055, CVE-2026-42530, and CVE-2026-48142. Organizations running affected versions should prioritize applying the available updates: NGINX Open Source 1.30.3 and 1.31.2, NGINX Plus R36 P6 and 37.0.2.1, and NGINX Gateway Fabric 2.6.4.
Given NGINX's widespread deployment as a web server and reverse proxy across enterprise environments, the remote code execution capability represents a significant attack surface. Organizations should review their NGINX deployments and apply vendor patches according to the referenced security bulletins.
Mentioned in this report
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0775/
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs