Critical NGINX Flaw Lets Attackers Crash Web Servers From Afar
F5 has patched CVE-2026-42533, a memory bug in nginx that a remote attacker can trigger with a single crafted request.
Key points
- F5 patched a critical flaw in nginx, tracked as CVE-2026-42533, on July 15.
- The bug lets a remote attacker crash the web server with a specially crafted HTTP request, no login needed.
- Fixes are in nginx 1.30.4 (stable), 1.31.3 (mainline), and NGINX Plus 37.0.3.1.
- Anyone running an older build should upgrade now.
- The vendor rates the flaw critical; public exploitation has not been confirmed at time of writing.
F5 has released fixes for a serious flaw in nginx, one of the most widely used web server programs on the internet. The bug lets an attacker send a booby-trapped web request from anywhere on the internet and knock the server over, with no username or password required.
The flaw is tracked as CVE-2026-42533. It sits in the part of nginx that handles incoming HTTP requests, the everyday messages your browser sends when it asks a site for a page.
What does this actually let attackers do?
It lets them crash the server on demand. The bug is what engineers call a heap buffer overflow, meaning the program writes more data into a chunk of memory than that chunk was built to hold. When that happens, the worker process (the part of nginx that answers requests) can fall over or restart.
In practice, a site sitting behind an unpatched nginx can be pushed into a denial of service, where legitimate visitors get errors or timeouts instead of the page they wanted. F5, which maintains nginx, says the flaw could in theory also open the door to remote code execution, meaning an attacker running their own commands on the server. That upper-end scenario is harder to pull off, and no working exploit for it has been made public.
The first reporting on the patch came from The Hacker News.
Who needs to patch?
Anyone running nginx on the open internet. The fixed versions are:
- nginx 1.30.4 on the stable branch
- nginx 1.31.3 on the mainline branch
- NGINX Plus 37.0.3.1, the commercial build
If you are on anything older than those, you are exposed. F5 shipped the updates on July 15. There is no configuration workaround called out by the vendor, so the fix is to upgrade.
For most organisations this is not a fire drill on the scale of a Log4j, but it is a serious one. nginx runs on a very large slice of the world's web servers, from small blogs to major streaming platforms and corporate front doors. A remotely triggerable crash bug in that codebase, reachable with a single request, is the kind of thing worm authors and denial-of-service crews look for.
What should ordinary users do?
Nothing on your own device. This is a server-side flaw, not something that infects your phone or laptop. If a site you use goes briefly offline in the coming weeks, that could be unrelated maintenance, or it could be someone's admin patching in a hurry. Either way, you do not need to change passwords or install anything.
If you run a website, or you are the person your family calls when the small business website breaks, check with your hosting provider that they have moved to a patched build. Managed hosts usually handle this quietly in the background. Self-managed servers do not.
Attribution note: there is no named group tied to this bug yet, and no in-the-wild exploitation reported. That may change quickly once proof-of-concept code appears. Given how attractive nginx is as a target, defenders should assume scanning for unpatched instances will pick up within days of any public write-up.
