CVE-2026-42055

NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability

HIGH

8.1

CVSS Score

Published: June 17, 2026 at 02:04 PM UTC

Updated: September 14, 2026 at 01:18 PM UTC

12 products affected across 2 vendorsEnterprise LinuxHardened ImagesNGINX Plus

Using NGINX Open Source by F5?

Get instant alerts when new vulnerabilities affect NGINX Open Source - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.1

Exploit prediction

EPSS 7%

SSVC

No known exploit

Description

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability exists when the proxy_http_version to 2 or grpc_pass directives are used to proxy HTTP/2 traffic, the ignore_invalid_headers directive is set to off, and the large_client_header_buffers directive size is larger than 2 megabytes. A remote, unauthenticated attacker, along with conditions beyond their control, could send large headers while creating an upstream request. This may cause a heap-based buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Dos · F5

95%

4.3.0 ≤ v ≤ 4.7.04.9.0

NGINX Gateway Fabric · F5

95%

1.3.0 ≤ v ≤ 1.6.22.0.0 ≤ v ≤ 2.6.3

NGINX Ingress Controller · F5

95%

3.5.0 ≤ v ≤ 3.7.24.0.0 ≤ v ≤ 4.0.15.0.0 ≤ v ≤ 5.5.0

NGINX Instance Manager · F5

95%

2.17.0 ≤ v ≤ 2.22.0

NGINX Open Source · F5

95%

1.0.0 ≤ v ≤ 1.30.21.13.10 ≤ v < 1.31.21.30.2 ≤ v < 1.30.31.31.0 ≤ v ≤ 1.31.11.13.10 1.30.2

Affected range stops below 1.30.3, so it looks safe — our inference, not a vendor statement

Affected range stops below 1.31.2, so it looks safe — our inference, not a vendor statement

NGINX Plus · F5

95%

37.0 ≤ v < 37.0.2.137.0.0.1 ≤ v < 37.0.2.1R36 ≤ v < R36 P6r33 ≤ v < r3637.0 R36 r36 r36 p1 r36 p2 r36 p3 r36 p4 r36 p5

Affected range stops below 37.0.2.1, so it looks safe — our inference, not a vendor statement

Affected range stops below R36 P6, so it looks safe — our inference, not a vendor statement

Affected range stops below r36, so it looks safe — our inference, not a vendor statement

Waf · F5

95%

4.10.0 ≤ v ≤ 4.16.05.2.0 ≤ v ≤ 5.8.05.9.0 ≤ v ≤ 5.13.1

Discovery · Red Hatcontainer

95%

All versions

Vendor states this is fixed in 1784821750 (unaffected)

Enterprise Linux · Red Hatrpm

95%

10.0 8.0 9.0

Vendor states this is fixed in 2:1.20.1-28.el9_8.4 (unaffected)

Vendor states this is fixed in 2:1.26.3-6.el10_2.5 (unaffected)

Vendor states this is fixed in 8100020260707171317.489197e6 (unaffected)

Vendor states this is fixed in 9080020260707110000.9 (unaffected)

Vendor states this is fixed in 9080020260707164406.9 (unaffected)

Hardened Images · Red Hatcontainer

95%

All versions

Vendor states this is fixed in 1.30.3-2.hum1 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (13)

Vendor Advisory

Source: cverecord

https://my.f5.com/manage/s/article/K000161584

Third Party Advisory