Our takeF5 advisory AV26-1049 covers multiple high-severity flaws in NGINX Gateway Fabric <2.8.0, Ingress Controller <5.7.0, JavaScript <1.0.2, Open Source <1.30.6/1.31.7 and Plus <37.0.5.1/37.1.0.1. Update affected instances now.Security Resilience desk
Sources (1)
- cccs · cccs
What this means for you — Security leader:Update NGINX Open Source to 1.30.6 or 1.31.7, NGINX Plus to 37.0.5.1 or 37.1.0.1, NGINX Ingress Controller to 5.7.0, NGINX Gateway Fabric to 2.8.0, and NGINX JavaScript to 1.0.2. Review your exposure and apply the patches in your next maintenance window.
What this means for you — Lean IT orgs:If you run any of the listed NGINX versions (Open Source, Plus, Ingress Controller, Gateway Fabric, or JavaScript module), update them immediately to the versions in the advisory. Most lean-IT teams can do this through your hosting provider or simple package update.
What this means for you — MSP:Audit all client environments for NGINX Open Source <1.30.6/1.31.7, Plus <37.0.5.1/37.1.0.1, Ingress Controller <5.7.0, Gateway Fabric <2.8.0, and JavaScript <1.0.2; patch them in the current cycle and confirm via version check.
What this means for you — Researcher:F5 advisory AV26-1049 details vulnerabilities affecting multiple NGINX products and versions; see the CCCS link for the full matrix.