F5 Patches Two Critical NGINX Open Source Flaws Enabling Remote Code Execution

F5 has issued patches for two critical vulnerabilities in NGINX Open Source, including CVE-2026-42530, a use-after-free flaw in the ngx_http_v3_module that allows remote code execution with a CVSS v4 score of 9.2. This vulnerability can be triggered by an unauthenticated attacker, making it a high-risk issue. The patch updates are crucial in preventing potential attacks that could compromise affected systems. The disclosure of CVE-2026-42530 expands the attack surface, emphasizing the need for swift mitigation¹. Given the severity of these flaws, users of NGINX Open Source should apply the security updates promptly to prevent exploitation. The vulnerabilities pose a significant risk to system security, and their resolution is essential to maintaining the integrity of affected systems. So what matters most to practitioners is the urgent need to prioritize patching based on their exposure and available exploitation evidence.