CVE-2026-60005 – F5 NGINX Plus

F5 has released updates for NGINX Plus to address two high-severity vulnerabilities affecting the NGINX data plane. The vulnerabilities involve a heap buffer overflow and uninitialized memory access that can be triggered by specially crafted HTTP requests under specific configuration conditions. Successful exploitation could result in denial of service, limited memory disclosure, or, in certain environments, arbitrary code execution.

CVE-2026-42533 has a CVSS score of 8.1, High severity. This heap buffer overflow can cause the NGINX worker process to restart and, on systems with Address Space Layout Randomization (ASLR) disabled or bypassed, could allow arbitrary code execution. CVE-2026-60005 has a CVSS score of 8.2, High severity. This vulnerability affects the ngx_http_slice_module and may allow limited memory disclosure or cause the NGINX worker process to restart when the module is enabled. Based on the information provided, there is no verified public exploitation or proof-of-concept associated with either vulnerability.