F5 Nginx Gateway Fabric vulnerabilities

21 CVEs affecting F5 Nginx Gateway Fabric, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-96615, published 2026-10-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-42055, published 2026-06-17. High severity, CVSS 8.1. EPSS: 6.5% chance of exploitation in the next 30 days. NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability exists when the proxy_http_version to 2 or…
CVE-2026-42945, published 2026-05-13. High severity, CVSS 8.1. EPSS: 3.4% chance of exploitation in the next 30 days. NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an…
CVE-2026-9256, published 2026-05-22. High severity, CVSS 8.1. EPSS: 2.7% chance of exploitation in the next 30 days. NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping…
CVE-2026-42530, published 2026-06-17. High severity, CVSS 8.1. EPSS: 1.1% chance of exploitation in the next 30 days. NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, a remote unauthenticated attacker along with conditions…
CVE-2026-42946, published 2026-05-13. High severity, CVSS 7.4. EPSS: 0.9% chance of exploitation in the next 30 days. A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data. When scgi_pass or uwsgi_pass is…
CVE-2026-42533, published 2026-07-15. High severity, CVSS 8.1. EPSS: 0.9% chance of exploitation in the next 30 days. A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map…
CVE-2026-42934, published 2026-05-13. Medium severity, CVSS 4.8. EPSS: 0.7% chance of exploitation in the next 30 days. NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map and proxy_pass with disabled buffering ("off") directives…
CVE-2026-40701, published 2026-05-13. Medium severity, CVSS 4.8. EPSS: 0.7% chance of exploitation in the next 30 days. NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the ssl_verify_client directive is set to "on" or "optional," and the ssl_ocsp directive is set to "on" or…
CVE-2026-66362, published 2026-09-02. High severity, CVSS 8.1. EPSS: 0.6% chance of exploitation in the next 30 days. Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric.…
CVE-2026-11311, published 2026-06-17. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied…

Latest

CVE-2026-96615, published 2026-10-14. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. Description NGINX Gateway Fabric has a vulnerability when it is configured with Gateway Custom Resource Definition (CRD) and have an authenticated gRPC connection with NGINX Agent. A namespaced …
CVE-2026-91184, published 2026-10-14. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. Description NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm (and spec.jwt.realm) field of a namespaced AuthenticationFilter verbatim, unescaped and unvalidated, into…
CVE-2026-60005, published 2026-07-15. High severity, CVSS 8.2. EPSS: 0.5% chance of exploitation in the next 30 days. NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captures are configured or when a background cache update…
CVE-2026-60065, published 2026-07-15. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. When NGINX Plus is configured to use the Message Queuing Telemetry Transport (MQTT) filter module (ngx_stream_mqtt_filter_module), unauthenticated attackers can send requests with conditions beyond…
CVE-2026-56434, published 2026-07-15. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module. This vulnerability may exist when the Server-Side Includes (SSI), proxy_pass, and proxy_buffering…
CVE-2026-50107, published 2026-06-17. High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days. When NGINX Plus or NGINX Open Source is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway…
CVE-2026-32682, published 2026-06-17. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. When NGINX Gateway Fabric is configured using GRPCRoutes, an authenticated, remote attacker with permission to create or modify GRPCRoute resources can cause the NGINX Gateway Fabric control plane to…
CVE-2026-48142, published 2026-06-17. Medium severity, CVSS 4.8. EPSS: 0.4% chance of exploitation in the next 30 days. NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When content is served or proxied through a location block with both source_charset utf-8; and a…