Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-42946 |
| Alert Source | F5 Security Advisory (K000160932) |
| CVE Publication Year | 2026 |
| Date Published | 2026-05-28 |
| Vendor | F5 (NGINX) |
| Product | NGINX |
| Vulnerability Type | Memory Corruption (Use-After-Free) |
| CVSS Score | 8.1 (high) |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
Source: F5 Security Advisory
Use-after-free vulnerability identified in NGINX. Published in the same advisory as the critical CVE-2026-42945 (RCE with public PoC) and the other memory corruption flaws (CVE-2026-40701, CVE-2026-42934).
Use-after-free bugs involve accessing memory after it has been freed — depending on race conditions and the attacker’s control over allocation, they can lead to worker process destabilization or potentially remote code execution.
Required Actions
All four bundle vulnerabilities are addressed in a single F5 patch package — one update eliminates the entire bundle. See the full list of affected products and steps in the CVE-2026-42945 alert.
The highest update priority is dictated by the criticality of CVE-2026-42945 (public PoC) — the other CVEs are fixed “along the way”.
Who Is Affected?
For the full list of affected NGINX and F5 products, see the CVE-2026-42945 alert. The bundle covers NGINX Open Source, NGINX Plus, NGINX Instance Manager, F5 WAF for NGINX, NGINX App Protect WAF/DoS, NGINX Gateway Fabric, and NGINX Ingress Controller.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
