F5 Patches Two Critical NGINX Open Source Flaws Enabling Remote Code Execution

F5 released updates addressing two critical NGINX vulnerabilities (CVE-2026-42530 and CVE-2026-42055) that may allow remote unauthenticated code execution under certain configurations; the advisory lists affected NGINX/Open Source, NGINX Plus, and multiple F5/NGINX product versions, provides fixed release versions, and recommends mitigations (disable HTTP/3 for CVE-2026-42530; remove ignore_invalid_headers off or reduce large_client_header_buffers for CVE-2026-42055). F5 reports no confirmed exploitation in the wild, but notes prior rapid exploitation of a similar NGINX defect.