F5 has issued out-of-band security patches to address several vulnerabilities in its NGINX web server products, including two critical-severity issues. These flaws could allow an attacker to execute arbitrary code on affected systems without authentication.
The two critical vulnerabilities carry the highest severity rating and pose a significant risk due to the widespread deployment of NGINX as a web server, reverse proxy, and load balancer. F5 did not disclose specific CVSS scores or exploitation status in the initial advisory.
Technical details remain limited, but the flaws are present in NGINX's HTTP/2 and HTTP/3 modules. Successful exploitation could enable remote code execution, potentially giving attackers full control over vulnerable servers. No indicators of compromise or proof-of-concept exploits have been publicly released yet.
F5 recommends administrators apply the out-of-band patches immediately to affected NGINX versions. The company has not provided workarounds or mitigations for those unable to update promptly. Specific version numbers and patch availability were not detailed in the advisory.
The vulnerabilities highlight the ongoing challenge of securing widely-used web infrastructure components. NGINX powers a significant portion of the internet, making these flaws attractive targets for threat actors. No attribution to any specific hacking group has been made at this time.