CVE-2026-60005Disclosure(f5 / nginx_gateway_fabric)

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch f5 nginx_gateway_fabric systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX worker process, leading to limited disclosure of memory or a restart. Impact: This vulnerability may allow remote, unauthenticated attackers to have limited control to disclose memory contents or restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only. Note: The ngx_http_slice_module module is not enabled by default; it's enabled with the --with-http_slice_module configuration parameter. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

f5 CVEs Back to dashboard

1.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://my.f5.com/manage/s/article/K000162100

Weakness type (CWE)

CWE-908

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

nginx_gateway_fabric
nginx_ingress_controller
nginx_instance_manager
nginx_open_source

Threat summary

Patch or workaround signal is available
9 mentions across 5 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 5 signals
Technical details provided in 7 signals
Disclosure: 4 classified signals
General: 2 classified signals
Peaked 4d ago at 4 mentions (2026-07-16); latest day: 1
9 total mentions across 5 days

Affected systems

Vendors

Products

nginx_gateway_fabricnginx_ingress_controllernginx_instance_managernginx_open_sourcenginx_pluswaf

4 versions affected across 6 products

Deep dive

Activity timeline9 mentions / 5d

Signal classification3 categories

Disclosure

444.4%

Patch

333.3%

General

222.2%

Referenced assets7 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-16	4	Disclosure3Patch1
2026-07-17	2	Disclosure1General1
2026-07-21	1	Patch1
2026-07-23	1	Patch1
2026-08-24	1	General1

Full discourse9 posts

Daily CyberSecurity@Daily_CyberSec92d
Patch
F5 patched the NGINX code execution flaw CVE-2026-42533, along with CVE-2026-60005 and CVE-2026-56434. Update NGINX Plus and Open Source builds now. #NGINX #CVE202642533 #CodeExecution #F5 #Vulnerability http://securityonline.info/nginx-code-execution-cve-2026-42533/
Post summary
F5 released patches for three NGINX CVEs (CVE‑2026‑42533, CVE‑2026‑60005, CVE‑2026‑56434), urging updates to NGINX Plus and Open Source builds.
020113712
12.9K followersView on X
Modat@modat_magnify91d
Disclosure
⚠️NGINX – Multiple Memory-Safety Flaws Patched (CVSS up to 9.2) F5 has patched three memory-safety flaws in NGINX. The most serious CVE-2026-42533 (CVSS 9.2) is a heap buffer overflow in the worker process when the map directive with regex matching references a capture before the map's output variable; a remote attacker can trigger it with crafted HTTP requests, and code execution is possible when ASLR is disabled or bypassed. CVE-2026-56434 is a use-after-free in the SSI filter module, exploitable by an attacker with man-in-the-middle control over upstream responses, enabling limited memory modification or a worker restart. CVE-2026-60005 is an uninitialized memory access in the slice module (not enabled by default) that can cause worker memory disclosure or termination. Affected: NGINX Open Source and NGINX Plus prior to 1.31.3. Mitigation: Upgrade to nginx 1.31.3 or later, and verify your distribution's build includes the fixes rather than trusting the version number alone. Modat Magnify Query: technology="Nginx" The platform: https://magnify.modat.io/ Reference: https://nginx.org/en/security_advisories.html #Modat #ModatMagnify #threatintel #vulnerability #CVE202642533 #CVE202656434 #CVE202660005 #NGINX #infosec #Critical
Post summary
NGINX has disclosed three memory‑safety CVEs with high CVSS scores, provided technical details, and issued patch guidance urging upgrade to version 1.31.3 or later.
01045444
1.8K followersView on X
Rıdvan Yağlı@ridvanyagli91d
Disclosure
🔴 NGINX kullanıcılarının dikkatine! F5, NGINX ve NGINX Plus'ı etkileyen 3 yüksek önem dereceli güvenlik açığını duyurdu. • CVE-2026-42533 – Heap Buffer Overflow • CVE-2026-60005 – Uninitialized Memory Disclosure • CVE-2026-56434 – Use-After-Free Etkilenen sistemlerde bellek bozulması, worker process çökmesi ve uygun koşullarda uzaktan kod çalıştırma (RCE) riski bulunuyor. NGINX versiyonlarınızı 1.31.3'e yükseltmeniz önerilir.
Post summary
The post announces three high‑severity CVEs affecting NGINX and its Plus edition, detailing heap overflow, memory disclosure, and use‑after‑free vulnerabilities that could lead to RCE, while recommending an upgrade to version 1.31.3.
02022340
2.2K followersView on X
Jangra@jxngrx86d
Patch
🚨 @nginxorg users, this is one to prioritize. A critical heap buffer overflow (CVE-2026-42533, CVSS 9.2) has been disclosed in both NGINX Open Source and NGINX Plus. The advisory also patches: • Memory disclosure (CVE-2026-60005) • Use-after-free (CVE-2026-56434) Most deployed NGINX versions are affected. There's no public exploit yet, but history shows it's only a matter of time. If you're running production workloads, upgrade to the latest patched release. #CyberSecurity #NGINX #Linux #DevOps #CloudSecurity #InfoSec #AppSec #OpenSource #SecurityNews #CVE
Post summary
The tweet announces a critical heap buffer overflow in NGINX, notes that an advisory supplies patches, confirms no exploit yet, and urges users to upgrade to the latest patched release.
2002068
573 followersView on X
iototsecnews@iototsecnews85d
Patch
NGINX の脆弱性 CVE-2026-56434／42533／60005 が FIX：RCE／メモリ漏洩／DoS の恐れ https://iototsecnews.jp/2026/07/16/f5-fixes-3-nginx-flaws-enabling-potential-remote-code-execution-memory-disclosure-and-dos-attacks/ 今回の 3 件の脆弱性は、 NGINX のリクエスト処理を行うデータ・プレーンに原因があります。最も深刻な CVE-2026-42533 は、マップ・ディレクティブと正規表現の処理方法の不備により、ヒープバッファ・オーバーフローを引き起こすものです。また、2 つ目の CVE-2026-56434 は、特定の SSI 設定時に解放済みメモリの使用を引き起こします。CVE-2026-60005 は slice モジュールで、未初期化メモリへのアクセスを許すという問題を引き起こします。いずれも、特定のモジュール利用や複雑な設定の組み合わせといった、内部の処理ロジックの隙が引き金となっています。ご利用のチームは、ご注意ください。 #CVE202642533 #CVE202656434 #CVE202660005 #F5 #nginx #Vulnerability
Post summary
The article announces that three critical NGINX CVEs have been fixed, provides technical details of each vulnerability, and confirms that patches are available.
01000145
501 followersView on X
Mohi@disismohi90d
Disclosure
CVE-2026-60005: NGINX slice module + regex captures = unauthenticated memory disclosure or worker restart. Data plane only. Here's what to check Friday.
Post summary
The post announces CVE-2026-60005, describing how the NGINX slice module’s regex capture can cause unauthenticated memory disclosure or worker restarts, with no PoC, exploit, patch or active exploitation cited.
1000055
73 followersView on X
ThreatWire@ThreatWire_91d
Disclosure
🚨 CVE-2026-42533, CVE-2026-60005 & CVE-2026-56434: F5 has disclosed three high-severity vulnerabilities affecting NGINX Plus and NGINX Open Source, potentially leading to memory corruption, worker crashes, or remote code execution. #CyberSecurity #CVE #NGINX #F5 #ThreatWire
Post summary
F5 announced three new high-severity vulnerabilities affecting NGINX Plus and Open Source that can lead to memory corruption, worker crashes, or remote code execution.
0001074
114 followersView on X
IntegSec@integ_sec52d
General
CVE-2026-60005: NGINX Uninitialized Memory Access Bug - What It Means for Your Business and How to Respond https://hubs.li/Q04v7t5q0
Post summary
The text announces the CVE-2026-60005 NGINX uninitialized memory access bug and links to a business‑impact article, but it does not provide exploit details, patches, or evidence of active exploitation.
0000036
33 followersView on X
Mohi@disismohi90d
General
F5 advisory: https://my.f5.com/manage/s/article/K000162100 Source: https://nvd.nist.gov/vuln/detail/CVE-2026-60005
Post summary
The post only points to an F5 advisory and the NVD entry for CVE‑2026‑60005, without providing further details or claims.
0000011
73 followersView on X

CPE platform detail18 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

18 of 18 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	f5	nginx_gateway_fabric	-	-	-
App	f5	nginx_ingress_controller	-	-	-
App	f5	nginx_ingress_controller	-	-	-
App	f5	nginx_ingress_controller	4.0.0	-	-
App	f5	nginx_ingress_controller	4.0.1	-	-
App	f5	nginx_instance_manager	-	-	-
App	f5	nginx_open_source	-	-	-
App	f5	nginx_open_source	1.31.2	-	-
App	f5	nginx_plus	-	-	-
App	f5	nginx_plus	-	-	-
App	f5	nginx_plus	r36	-	-
App	f5	nginx_plus	r36	-	-
App	f5	nginx_plus	r36	-	-
App	f5	nginx_plus	r36	-	-
App	f5	nginx_plus	r36	-	-
App	f5	nginx_plus	r36	-	-
App	f5	nginx_plus	r36	-	-
App	f5	waf	-	nginx	-

Explore more

Back to dashboard f5 CVEs nginx_gateway_fabric vulnerabilities

What researchers are saying

CVE-2026-60005

Modat[verified]@modat_magnifyDisclosure

NGINX has disclosed three memory‑safety CVEs with high CVSS scores, provided technical details, and issued patch guidance urging upgrade to version 1.31.3 or later.

Rıdvan Yağlı[verified]@ridvanyagliDisclosure

The post announces three high‑severity CVEs affecting NGINX and its Plus edition, detailing heap overflow, memory disclosure, and use‑after‑free vulnerabilities that could lead to RCE, while recommending an upgrade to version 1.31.3.

Jangra[verified]@jxngrxPatch

The tweet announces a critical heap buffer overflow in NGINX, notes that an advisory supplies patches, confirms no exploit yet, and urges users to upgrade to the latest patched release.

Mohi[verified]@disismohiDisclosure

The post announces CVE-2026-60005, describing how the NGINX slice module’s regex capture can cause unauthenticated memory disclosure or worker restarts, with no PoC, exploit, patch or active exploitation cited.

IntegSec[verified]@integ_secGeneral

The text announces the CVE-2026-60005 NGINX uninitialized memory access bug and links to a business‑impact article, but it does not provide exploit details, patches, or evidence of active exploitation.

Mohi[verified]@disismohiGeneral

The post only points to an F5 advisory and the NVD entry for CVE‑2026‑60005, without providing further details or claims.

Daily CyberSecurity@Daily_CyberSecPatch

F5 released patches for three NGINX CVEs (CVE‑2026‑42533, CVE‑2026‑60005, CVE‑2026‑56434), urging updates to NGINX Plus and Open Source builds.

iototsecnews@iototsecnewsPatch

The article announces that three critical NGINX CVEs have been fixed, provides technical details of each vulnerability, and confirms that patches are available.