Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-40701 |
| Alert Source | F5 Security Advisory (K000160932) |
| CVE Publication Year | 2026 |
| Date Published | 2026-05-28 |
| Vendor | F5 (NGINX) |
| Product | NGINX |
| Vulnerability Type | Denial of Service (Memory Corruption / Crash) |
| CVSS Score | 7.5 (high) |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
Source: F5 Security Advisory
A memory corruption vulnerability leading to NGINX worker process crash (Denial of Service). Published in the same advisory as the critical CVE-2026-42945 (RCE with public PoC) and the other memory corruption flaws (CVE-2026-42946, CVE-2026-42934).
Successful exploitation causes worker process crash and can be used for performance degradation or complete service unavailability (if the attack is repeatable).
Required Actions
All four bundle vulnerabilities are addressed in a single F5 patch package — one update eliminates the entire bundle. See the full list of affected products and steps in the CVE-2026-42945 alert.
Who Is Affected?
For the full list of affected NGINX and F5 products, see the CVE-2026-42945 alert. The bundle covers NGINX Open Source, NGINX Plus, NGINX Instance Manager, F5 WAF for NGINX, NGINX App Protect WAF/DoS, NGINX Gateway Fabric, and NGINX Ingress Controller.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
