{"id":1656,"date":"2026-06-19T07:21:14","date_gmt":"2026-06-19T00:21:14","guid":{"rendered":"https:\/\/vncybers.vn\/f5-ban-va-khan-lo-hong-nginx-cve-2026-42530-cve-2026-42055\/"},"modified":"2026-06-19T07:21:14","modified_gmt":"2026-06-19T00:21:14","slug":"f5-ban-va-khan-lo-hong-nginx-cve-2026-42530-cve-2026-42055","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/f5-ban-va-khan-lo-hong-nginx-cve-2026-42530-cve-2026-42055\/","title":{"rendered":"F5 ph\u00e1t h\u00e0nh b\u1ea3n v\u00e1 kh\u1ea9n cho c\u00e1c l\u1ed7 h\u1ed5ng NGINX c\u00f3 th\u1ec3 d\u1eabn \u0111\u1ebfn DoS v\u00e0 th\u1ef1c thi m\u00e3"},"content":{"rendered":"

F5 \u0111\u00e3 ph\u00e1t h\u00e0nh b\u1ea3n c\u1eadp nh\u1eadt b\u1ea3o m\u1eadt ngo\u00e0i chu k\u1ef3 cho NGINX sau khi ghi nh\u1eadn nhi\u1ec1u l\u1ed7 h\u1ed5ng m\u1edbi trong c\u00e1c th\u00e0nh ph\u1ea7n x\u1eed l\u00fd HTTP\/3, proxy v\u00e0 gRPC. V\u1ea5n \u0111\u1ec1 \u0111\u00e1ng ch\u00fa \u00fd l\u00e0 m\u1ed9t s\u1ed1 l\u1ed7i c\u00f3 th\u1ec3 b\u1ecb khai th\u00e1c t\u1eeb xa, kh\u00f4ng c\u1ea7n x\u00e1c th\u1ef1c, trong c\u00e1c c\u1ea5u h\u00ecnh kh\u00f4ng m\u1eb7c \u0111\u1ecbnh v\u00e0 c\u00f3 kh\u1ea3 n\u0103ng d\u1eabn \u0111\u1ebfn gi\u00e1n \u0111o\u1ea1n d\u1ecbch v\u1ee5 ho\u1eb7c th\u1ef1c thi m\u00e3 trong \u0111i\u1ec1u ki\u1ec7n nh\u1ea5t \u0111\u1ecbnh.<\/p>\n

Th\u00f4ng tin n\u00e0y \u0111\u00e1ng ch\u00fa \u00fd v\u00ec NGINX l\u00e0 m\u1ed9t trong nh\u1eefng n\u1ec1n t\u1ea3ng web server, reverse proxy v\u00e0 gateway ph\u1ed5 bi\u1ebfn trong h\u1ea1 t\u1ea7ng doanh nghi\u1ec7p. V\u1edbi c\u00e1c h\u1ec7 th\u1ed1ng internet-facing, r\u1ee7i ro kh\u00f4ng ch\u1ec9 n\u1eb1m \u1edf b\u1ea3n th\u00e2n l\u1ed7 h\u1ed5ng m\u00e0 c\u00f2n \u1edf t\u1ed1c \u0111\u1ed9 r\u00e0 so\u00e1t c\u1ea5u h\u00ecnh, c\u1eadp nh\u1eadt phi\u00ean b\u1ea3n v\u00e0 x\u00e1c \u0111\u1ecbnh d\u1ecbch v\u1ee5 n\u00e0o \u0111ang b\u1eadt c\u00e1c module li\u00ean quan.<\/p>\n

\"H\u1ea1<\/p>\n

C\u00e1c l\u1ed7 h\u1ed5ng ch\u00ednh \u0111\u01b0\u1ee3c c\u00f4ng b\u1ed1<\/h2>\n

Theo danh s\u00e1ch advisory ch\u00ednh th\u1ee9c c\u1ee7a NGINX, CVE-2026-42530 l\u00e0 l\u1ed7i use-after-free trong module HTTP\/3. NGINX ghi nh\u1eadn c\u00e1c phi\u00ean b\u1ea3n kh\u00f4ng b\u1ecb \u1ea3nh h\u01b0\u1edfng l\u00e0 1.31.2 tr\u1edf l\u00ean, trong khi nh\u00e1nh 1.31.0 \u0111\u1ebfn 1.31.1 n\u1eb1m trong v\u00f9ng r\u1ee7i ro n\u1ebfu c\u1ea5u h\u00ecnh li\u00ean quan \u0111\u01b0\u1ee3c k\u00edch ho\u1ea1t.<\/p>\n

L\u1ed7 h\u1ed5ng CVE-2026-42055 li\u00ean quan \u0111\u1ebfn ngx_http_proxy_v2_module v\u00e0 ngx_http_grpc_module. NGINX cho bi\u1ebft c\u00e1c phi\u00ean b\u1ea3n 1.31.2 tr\u1edf l\u00ean v\u00e0 1.30.3 tr\u1edf l\u00ean kh\u00f4ng b\u1ecb \u1ea3nh h\u01b0\u1edfng, c\u00f2n c\u00e1c phi\u00ean b\u1ea3n t\u1eeb 1.13.10 \u0111\u1ebfn 1.31.1 c\u1ea7n \u0111\u01b0\u1ee3c r\u00e0 so\u00e1t theo advisory. BleepingComputer d\u1eabn th\u00f4ng tin t\u1eeb F5 cho bi\u1ebft vi\u1ec7c khai th\u00e1c th\u00e0nh c\u00f4ng c\u00f3 th\u1ec3 g\u00e2y kh\u1edfi \u0111\u1ed9ng l\u1ea1i worker process v\u00e0 trong m\u1ed9t s\u1ed1 \u0111i\u1ec1u ki\u1ec7n nh\u01b0 ASLR b\u1ecb v\u00f4 hi\u1ec7u h\u00f3a ho\u1eb7c b\u1ecb v\u01b0\u1ee3t qua, c\u00f3 th\u1ec3 d\u1eabn t\u1edbi th\u1ef1c thi m\u00e3.<\/p>\n

V\u00ec sao c\u00e1c c\u1ea5u h\u00ecnh kh\u00f4ng m\u1eb7c \u0111\u1ecbnh v\u1eabn c\u1ea7n \u0111\u01b0\u1ee3c \u01b0u ti\u00ean<\/h2>\n

Nhi\u1ec1u t\u1ed5 ch\u1ee9c c\u00f3 xu h\u01b0\u1edbng \u0111\u00e1nh gi\u00e1 th\u1ea5p c\u00e1c l\u1ed7 h\u1ed5ng ch\u1ec9 \u1ea3nh h\u01b0\u1edfng \u0111\u1ebfn c\u1ea5u h\u00ecnh kh\u00f4ng m\u1eb7c \u0111\u1ecbnh. Tuy nhi\u00ean, trong m\u00f4i tr\u01b0\u1eddng s\u1ea3n xu\u1ea5t, c\u1ea5u h\u00ecnh NGINX th\u01b0\u1eddng \u0111\u01b0\u1ee3c t\u00f9y bi\u1ebfn s\u00e2u \u0111\u1ec3 ph\u1ee5c v\u1ee5 HTTP\/3, gRPC, reverse proxy, c\u00e2n b\u1eb1ng t\u1ea3i, API gateway ho\u1eb7c ki\u1ebfn tr\u00fac microservices. \u0110i\u1ec1u n\u00e0y khi\u1ebfn c\u00e2u h\u1ecfi quan tr\u1ecdng kh\u00f4ng ph\u1ea3i l\u00e0 h\u1ec7 th\u1ed1ng c\u00f3 d\u00f9ng NGINX hay kh\u00f4ng, m\u00e0 l\u00e0 module n\u00e0o \u0111ang b\u1eadt v\u00e0 phi\u00ean b\u1ea3n n\u00e0o \u0111ang ch\u1ea1y \u1edf t\u1eebng l\u1edbp h\u1ea1 t\u1ea7ng.<\/p>\n

HTTP\/3 v\u00e0 gRPC ng\u00e0y c\u00e0ng ph\u1ed5 bi\u1ebfn trong c\u00e1c d\u1ecbch v\u1ee5 c\u1ea7n \u0111\u1ed9 tr\u1ec5 th\u1ea5p ho\u1eb7c giao ti\u1ebfp gi\u1eefa nhi\u1ec1u th\u00e0nh ph\u1ea7n backend. Khi l\u1ed7i n\u1eb1m \u1edf t\u1ea7ng x\u1eed l\u00fd giao th\u1ee9c ho\u1eb7c header, r\u1ee7i ro c\u00f3 th\u1ec3 lan t\u1edbi c\u00e1c d\u1ecbch v\u1ee5 t\u01b0\u1edfng nh\u01b0 ch\u1ec9 \u0111\u00f3ng vai tr\u00f2 trung gian, \u0111\u1eb7c bi\u1ec7t n\u1ebfu ch\u00fang n\u1eb1m tr\u01b0\u1edbc nhi\u1ec1u \u1ee9ng d\u1ee5ng n\u1ed9i b\u1ed9.<\/p>\n

T\u00e1c \u0111\u1ed9ng \u0111\u1ed1i v\u1edbi \u0111\u1ed9i v\u1eadn h\u00e0nh v\u00e0 b\u1ea3o m\u1eadt<\/h2>\n

T\u00e1c \u0111\u1ed9ng tr\u1ef1c ti\u1ebfp nh\u1ea5t l\u00e0 nguy c\u01a1 t\u1eeb ch\u1ed1i d\u1ecbch v\u1ee5, khi\u1ebfn worker process c\u1ee7a NGINX b\u1ecb restart v\u00e0 \u1ea3nh h\u01b0\u1edfng \u0111\u1ebfn kh\u1ea3 n\u0103ng ph\u1ee5c v\u1ee5 truy c\u1eadp. V\u1edbi h\u1ec7 th\u1ed1ng c\u00f3 l\u01b0u l\u01b0\u1ee3ng cao, s\u1ef1 c\u1ed1 l\u1eb7p l\u1ea1i c\u00f3 th\u1ec3 t\u1ea1o ra hi\u1ec7u \u1ee9ng d\u00e2y chuy\u1ec1n: gateway qu\u00e1 t\u1ea3i, backend b\u1ecb d\u1ed3n k\u1ebft n\u1ed1i, gi\u00e1m s\u00e1t sinh c\u1ea3nh b\u00e1o nhi\u1ec5u v\u00e0 \u0111\u1ed9i v\u1eadn h\u00e0nh kh\u00f3 ph\u00e2n bi\u1ec7t gi\u1eefa l\u1ed7i c\u1ea5u h\u00ecnh, l\u01b0u l\u01b0\u1ee3ng b\u1ea5t th\u01b0\u1eddng v\u00e0 khai th\u00e1c c\u00f3 ch\u1ee7 \u0111\u00edch.<\/p>\n

Kh\u1ea3 n\u0103ng th\u1ef1c thi m\u00e3, d\u00f9 ph\u1ee5 thu\u1ed9c v\u00e0o \u0111i\u1ec1u ki\u1ec7n b\u1ed5 sung, v\u1eabn l\u00e0 t\u00edn hi\u1ec7u c\u1ea7n x\u1eed l\u00fd nghi\u00eam t\u00fac. C\u00e1c m\u00e1y ch\u1ee7 reverse proxy th\u01b0\u1eddng c\u00f3 quy\u1ec1n truy c\u1eadp t\u1edbi nhi\u1ec1u v\u00f9ng m\u1ea1ng, token d\u1ecbch v\u1ee5, log nh\u1ea1y c\u1ea3m ho\u1eb7c backend n\u1ed9i b\u1ed9. V\u00ec v\u1eady, b\u1ea3n v\u00e1 cho NGINX kh\u00f4ng n\u00ean \u0111\u01b0\u1ee3c xem l\u00e0 t\u00e1c v\u1ee5 b\u1ea3o tr\u00ec th\u00f4ng th\u01b0\u1eddng, m\u00e0 l\u00e0 m\u1ed9t ph\u1ea7n c\u1ee7a quy tr\u00ecnh gi\u1ea3m thi\u1ec3u r\u1ee7i ro h\u1ea1 t\u1ea7ng.<\/p>\n

Recommended response<\/h2>\n

Qu\u1ea3n tr\u1ecb vi\u00ean n\u00ean l\u1eadp danh s\u00e1ch to\u00e0n b\u1ed9 m\u00e1y ch\u1ee7, container image, ingress controller, gateway ho\u1eb7c appliance c\u00f3 s\u1eed d\u1ee5ng NGINX, sau \u0111\u00f3 \u0111\u1ed1i chi\u1ebfu v\u1edbi advisory ch\u00ednh th\u1ee9c. C\u00e1c h\u1ec7 th\u1ed1ng ch\u1ea1y NGINX Open Source n\u00ean \u01b0u ti\u00ean c\u1eadp nh\u1eadt l\u00ean 1.31.2 ho\u1eb7c 1.30.3 t\u00f9y nh\u00e1nh ph\u00f9 h\u1ee3p. V\u1edbi NGINX Plus, NGINX Gateway Fabric v\u00e0 c\u00e1c s\u1ea3n ph\u1ea9m li\u00ean quan, c\u1ea7n theo d\u00f5i h\u01b0\u1edbng d\u1eabn ri\u00eang t\u1eeb F5.<\/p>\n

Trong th\u1eddi gian ch\u1edd c\u1eadp nh\u1eadt, \u0111\u1ed9i v\u1eadn h\u00e0nh n\u00ean r\u00e0 so\u00e1t vi\u1ec7c b\u1eadt HTTP\/3, gRPC proxy, proxy protocol v\u00e0 c\u00e1c thi\u1ebft l\u1eadp header c\u00f3 li\u00ean quan. Nh\u1eefng c\u1ea5u h\u00ecnh kh\u00f4ng c\u1ea7n thi\u1ebft n\u00ean \u0111\u01b0\u1ee3c t\u1eaft ho\u1eb7c gi\u1edbi h\u1ea1n \u1edf ph\u1ea1m vi n\u1ed9i b\u1ed9. Log truy c\u1eadp, log l\u1ed7i v\u00e0 t\u00edn hi\u1ec7u restart worker process c\u0169ng c\u1ea7n \u0111\u01b0\u1ee3c theo d\u00f5i \u0111\u1ec3 ph\u00e1t hi\u1ec7n c\u00e1c m\u1eabu request b\u1ea5t th\u01b0\u1eddng.<\/p>\n

B\u00e0i h\u1ecdc cho qu\u1ea3n tr\u1ecb h\u1ea1 t\u1ea7ng web<\/h2>\n

S\u1ef1 ki\u1ec7n n\u00e0y cho th\u1ea5y m\u1ed9t \u0111i\u1ec3m quen thu\u1ed9c trong an ninh h\u1ea1 t\u1ea7ng: th\u00e0nh ph\u1ea7n c\u00e0ng ph\u1ed5 bi\u1ebfn, t\u00e1c \u0111\u1ed9ng c\u1ee7a m\u1ed9t l\u1ed7i c\u1ea5u h\u00ecnh c\u00e0ng r\u1ed9ng. NGINX th\u01b0\u1eddng n\u1eb1m \u1edf l\u1edbp \u0111\u1ea7u v\u00e0o c\u1ee7a h\u1ec7 th\u1ed1ng, n\u00ean vi\u1ec7c ki\u1ec3m k\u00ea phi\u00ean b\u1ea3n, module v\u00e0 c\u1ea5u h\u00ecnh th\u1ef1c t\u1ebf c\u1ea7n \u0111\u01b0\u1ee3c duy tr\u00ec li\u00ean t\u1ee5c thay v\u00ec ch\u1ec9 th\u1ef1c hi\u1ec7n khi c\u00f3 c\u1ea3nh b\u00e1o l\u1edbn.<\/p>\n

V\u1edbi c\u00e1c t\u1ed5 ch\u1ee9c v\u1eadn h\u00e0nh nhi\u1ec1u m\u00f4i tr\u01b0\u1eddng, c\u00e1ch ti\u1ebfp c\u1eadn hi\u1ec7u qu\u1ea3 l\u00e0 k\u1ebft h\u1ee3p qu\u1ea3n l\u00fd t\u00e0i s\u1ea3n, qu\u00e9t c\u1ea5u h\u00ecnh, ki\u1ec3m so\u00e1t image build v\u00e0 quy tr\u00ecnh c\u1eadp nh\u1eadt c\u00f3 th\u1ec3 rollback. Khi c\u00f3 b\u1ea3n v\u00e1 ngo\u00e0i chu k\u1ef3 t\u1eeb nh\u00e0 cung c\u1ea5p, \u0111\u1ed9i b\u1ea3o m\u1eadt c\u1ea7n nhanh ch\u00f3ng chuy\u1ec3n advisory th\u00e0nh danh s\u00e1ch h\u1ec7 th\u1ed1ng b\u1ecb \u1ea3nh h\u01b0\u1edfng, m\u1ee9c \u01b0u ti\u00ean x\u1eed l\u00fd v\u00e0 ti\u00eau ch\u00ed x\u00e1c minh sau c\u1eadp nh\u1eadt.<\/p>\n

VNCyberS<\/strong> t\u1ed5ng h\u1ee3p t\u1eeb BleepingComputer, F5 v\u00e0 NGINX<\/em><\/p>","protected":false},"excerpt":{"rendered":"

F5 \u0111\u00e3 ph\u00e1t h\u00e0nh b\u1ea3n c\u1eadp nh\u1eadt b\u1ea3o m\u1eadt ngo\u00e0i chu k\u1ef3 cho NGINX sau khi ghi nh\u1eadn nhi\u1ec1u l\u1ed7 h\u1ed5ng m\u1edbi trong c\u00e1c th\u00e0nh ph\u1ea7n x\u1eed l\u00fd HTTP\/3, proxy v\u00e0 gRPC. V\u1ea5n \u0111\u1ec1 \u0111\u00e1ng ch\u00fa \u00fd l\u00e0 m\u1ed9t s\u1ed1 l\u1ed7i c\u00f3 th\u1ec3 b\u1ecb khai th\u00e1c t\u1eeb xa, kh\u00f4ng c\u1ea7n x\u00e1c th\u1ef1c, trong c\u00e1c c\u1ea5u […]<\/p>\n","protected":false},"author":2,"featured_media":1655,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[5],"tags":[210,207,206,211,204,209,208,34,205,212],"class_list":["post-1656","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-kien-thuc","tag-ban-va-bao-mat","tag-cve-2026-42055","tag-cve-2026-42530","tag-dos","tag-f5","tag-grpc","tag-http-3","tag-lo-hong-bao-mat","tag-nginx","tag-thuc-thi-ma-tu-xa"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1656","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=1656"}],"version-history":[{"count":0,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1656\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/1655"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=1656"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=1656"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=1656"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}