NGINX HTTP/2 Proxy Body Injection Vulnerability
CVE-2026-42926 Published on May 13, 2026
NGINX ngx_http_proxy_v2_module vulnerability
When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also uses proxy_set_body, an attacker may be able to inject frame headers and payload bytes to the upstream peer. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Vulnerability Analysis
CVE-2026-42926 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, with no impact on integrity, and no impact on availability.
Weakness Type
Encoding Error
The software does not properly encode or decode the data, resulting in unexpected values.
Products Associated with CVE-2026-42926
Want to know whenever a new CVE is published for F5 Networks Nginx Open Source? stack.watch will email you.
Affected Versions
F5 NGINX Open Source:- Version 1.31.0 and below * is unaffected.
- Version 1.29.4 and below 1.30.1 is affected.