F5 issues out-of-band patches for critical NGINX vulnerabilities

F5 issued emergency out-of-band patches for two critical vulnerabilities in NGINX — a use-after-free flaw and a heap-based buffer overflow — both of which can be exploited by unauthenticated remote attackers to execute arbitrary code or cause denial-of-service. The severity is compounded when ASLR (Address Space Layout Randomization) is disabled or bypassed, removing a key memory protection layer. Additionally, high-severity configuration injection flaws in NGINX Gateway Fabric expose authenticated pathways to further compromise. Because NGINX is one of the most widely deployed web servers globally, the blast radius of these vulnerabilities is enormous. Organizations that lack rapid patching processes for critical internet-facing infrastructure are especially at risk of full system compromise.