NGINX Heap Buffer Overflow via Large HTTP/2 Headers in Proxy Modules
CVE-2026-42055 Published on June 17, 2026

NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability exists when the proxy_http_version to 2 or grpc_pass directives are used to proxy HTTP/2 traffic, the ignore_invalid_headers directive is set to off, and the large_client_header_buffers directive size is larger than 2 megabytes. A remote, unauthenticated attacker, along with conditions beyond their control, could send large headers while creating an upstream request. This may cause a heap-based buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-42055 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.

Attack Vector:
NETWORK
Attack Complexity:
HIGH
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Weakness Types

Heap-based Buffer Overflow

A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Incorrect Calculation of Buffer Size

The software does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.


Products Associated with CVE-2026-42055

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-42055 are published in these products:

F5 Networks Nginx Open Source
 
F5 Networks Nginx Plus
 
Red Hat Hummingbird
 
Red Hat Enterprise Linux (RHEL)
 
Red Hat Openshift Data Foundation
 

Affected Versions

F5 NGINX Open Source: F5 NGINX Plus: Red Hat Enterprise Linux AppStream (v. 10): Red Hat Enterprise Linux AppStream (v. 9): Red Hat Enterprise Linux CodeReady Linux Builder (v. 10): Red Hat Enterprise Linux CodeReady Linux Builder (v. 9): Red Hat Hardened Images: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 9: Red Hat Openshift Data Foundation 4:

Exploit Probability

EPSS
0.64%
Percentile
45.69%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.