Executive brief
NGINX Plus and NGINX Open Source, widely used web servers and load balancers, contain a vulnerability in their SSL module when specific client verification and certificate status features are enabled. An unauthenticated attacker can send specially crafted network requests that may cause the NGINX worker process to crash or allow for limited unauthorized data modification. This can lead to service instability and potential disruptions to web application availability.
Technical details
A heap-use-after-free vulnerability exists in the ngx_http_ssl_module of NGINX Plus and NGINX Open Source. The flaw is triggered when 'ssl_verify_client' is set to 'on' or 'optional' and 'ssl_ocsp' is enabled (or leaf parameters are configured with a resolver). An unauthenticated remote attacker can exploit this by sending requests under specific conditions beyond their direct control, leading to a worker process restart (DoS) or limited data modification. The vulnerability is tracked as CVE-2026-40701 and has been addressed in NGINX Open Source 1.30.1 and specific patches for NGINX Plus R32 and R36.
Affected products
- F5 NGINX Plus R32 up to R32 P6, R36 up to R36 P4
- F5 NGINX Open Source 1.19.0 up to 1.30.1
- F5 NGINX Ingress Controller 4.0.0-4.0.1, 3.5.0-3.7.2, 5.0.0-5.4.2
- F5 NGINX Gateway Fabric 1.3.0-1.6.2, 2.0.0-2.6.0
Timeline
- 2026-05-13: advisory: Initial advisory published by F5 Networks
- 2026-05-13: disclosed