CVE-2026-42946: F5 NGINX memory over-read in SCGI and uWSGI modules

CVE-2026-42946 · Severity: medium · CVSS 6.5 · Published 2026-05-13

A vulnerability in NGINX's SCGI and uWSGI modules could allow an attacker to access sensitive information or disrupt web services. By intercepting traffic between NGINX and its backend servers, an attacker can cause the system to leak process memory or crash the worker service. This could lead to the exposure of private data or a temporary outage of the affected website or application.

Technologies: F5 Nginx Gateway Fabric, F5 Nginx Ingress Controller, F5 Nginx Plus. Vendors: F5.

Quick answers

Is CVE-2026-42946 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42946 being exploited in the wild.
How severe is CVE-2026-42946?
Medium severity, with a CVSS score of 6.5, published 13 May 2026.
Which products and versions are affected?
F5 Nginx EoTS versions not evaluated; F5 NGINX App Protect WAF 4.9.0 to 4.16.0, 5.1.0 to 5.12.1; F5 Nginx Gateway Fabric 1.3.0 to 1.6.2, 2.0.0 to 2.6.0; F5 Nginx Ingress Controller 3.5.0 to 3.7.2, 4.0.0 to 4.0.1, 5.0.0 to 5.4.2; and 1 more.
Is there a fix for CVE-2026-42946?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-42946 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-42946?
Check whether you run F5 Nginx, F5 NGINX App Protect WAF, F5 Nginx Gateway Fabric or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules due to improper handling of upstream responses. When scgi_pass or uwsgi_pass is configured, an unauthenticated attacker with man-in-the-middle (MITM) capabilities can manipulate responses from an upstream server to trigger excessive memory allocation (CWE-789) or an out-of-range pointer offset (CWE-823). This can result in an over-read of NGINX worker process memory or a denial-of-service condition by crashing the worker process. The attack requires the ability to control the network path between NGINX and the backend server. F5 has released security advisories detailing affected versions across their NGINX product line.

Affected products

  • F5 NGINX Open Source 0.8.42 to 1.30.0
  • F5 NGINX Plus r32 to r36
  • F5 NGINX Ingress Controller 3.5.0 to 3.7.2, 4.0.0 to 4.0.1, 5.0.0 to 5.4.2
  • F5 NGINX App Protect WAF 4.9.0 to 4.16.0, 5.1.0 to 5.12.1
  • F5 NGINX Gateway Fabric 1.3.0 to 1.6.2, 2.0.0 to 2.6.0

Timeline

  • 2026-05-13: advisory: Initial advisory published by F5 Networks

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.