CVE-2026-42945 – NGINX
CVSS 8.1
IMPORTANT
“Remote code execution in edge infrastructure can put business traffic and backend systems at risk fast.”
F5 released patches for three high-severity vulnerabilities affecting NGINX Plus and NGINX JavaScript. CVE-2026-42945 has a CVSS score of 8.1, which is High severity. CVE-2026-8711 has a CVSS score of 8.1, which is High severity. CVE-2026-9256 has a CVSS score of 8.1, which is High severity.
The update addresses heap-based buffer overflow conditions that could allow remote code execution in affected NGINX deployments. These fixes reduce the risk of attackers abusing exposed web infrastructure to execute code through vulnerable request handling paths.
Key Details
- Affected Product
- F5 Dos
- Attack Vector
- Network
- Attack Complexity
- High
- Privileges Required
- None
- User Interaction
- None
- CWE Classification
- CWE-122
Patch this CVE on all your endpoints in under 5 minutes.
First 200 endpoints are free forever, scale as needed.