Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-42934 |
| Alert Source | F5 Security Advisory (K000160932) |
| CVE Publication Year | 2026 |
| Date Published | 2026-05-28 |
| Vendor | F5 (NGINX) |
| Product | NGINX |
| Vulnerability Type | Memory Corruption (Out-of-Bounds Read) |
| CVSS Score | 6.5 (high) |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
Source: F5 Security Advisory
Out-of-bounds read vulnerability in NGINX — allows reading memory beyond the bounds of an allocated buffer, which may lead to disclosure of sensitive data from the worker process memory (e.g., fragments of other users’ requests, session keys, configuration data). Published in the same advisory as the critical CVE-2026-42945 (RCE with public PoC) and the other memory corruption flaws (CVE-2026-42946, CVE-2026-40701).
Out-of-bounds read consequences may include sensitive information disclosure and providing an attacker with insight into process memory layout — facilitating the development of more advanced exploits.
Required Actions
All four bundle vulnerabilities are addressed in a single F5 patch package — one update eliminates the entire bundle. See the full list of affected products and steps in the CVE-2026-42945 alert.
Who Is Affected?
For the full list of affected NGINX and F5 products, see the CVE-2026-42945 alert. The bundle covers NGINX Open Source, NGINX Plus, NGINX Instance Manager, F5 WAF for NGINX, NGINX App Protect WAF/DoS, NGINX Gateway Fabric, and NGINX Ingress Controller.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
