F5 Patches Two Critical NGINX Open Source Flaws Enabling Remote Code Execution

F5 published patches for two critical NGINX Open Source vulnerabilities — most notably CVE-2026-42530, a CVSS 9.2 use-after-free in the HTTP/3 (ngx_http_v3_module) that enables unauthenticated remote code execution when HTTP/3 is enabled; administrators are urged to apply the June 18, 2026 patches immediately, disable HTTP/3 or block UDP/443 as temporary mitigations, and monitor for exploitation given NGINX's broad global use.