---
id: CVE-2026-42055
title: "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module\_and ngx_http_grpc_module\_modules"
summary: "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module\_and ngx_http_grpc_module\_modules. This vulnerability exists when the proxy_http_version to 2\_or grpc_pass\_directives are used to proxy HTTP/2 traffic, …"
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-122
  - CWE-787
  - CWE-131
vendor: f5
product: dos
affected:
  - 'dos >= 4.3.0, <= 4.7.0'
  - dos = 4.9.0
  - 'nginx_gateway_fabric >= 1.3.0, <= 1.6.2'
  - 'nginx_gateway_fabric >= 2.0.0, <= 2.6.3'
  - 'nginx_ingress_controller >= 3.5.0, <= 3.7.2'
  - 'nginx_ingress_controller >= 4.0.0, <= 4.0.1'
  - 'nginx_ingress_controller >= 5.0.0, <= 5.5.0'
  - 'nginx_instance_manager >= 2.17.0, <= 2.22.0'
  - 'nginx_open_source >= 1.0.0, <= 1.30.2'
  - 'nginx_open_source >= 1.31.0, <= 1.31.1'
  - 'nginx_plus >= 37.0.0.1, < 37.0.2.1'
  - 'nginx_plus >= r33, < r36'
  - nginx_plus = r36
  - 'waf >= 4.10.0, <= 4.16.0'
  - 'waf >= 5.2.0, <= 5.8.0'
  - 'waf >= 5.9.0, <= 5.13.1'
  - discovery
  - hardened_images
  - 'update_infrastructure >= 5.0, < 5.2'
  - enterprise_linux = 8.0
  - enterprise_linux = 9.0
  - enterprise_linux = 10.0
patched:
  - nginx_plus r36
  - update_infrastructure 5.2
published: '2026-06-17'
updated: '2026-09-14'
sourceUpdated: '2026-09-14T13:18:34.690'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-42055'
references:
  - url: 'https://my.f5.com/manage/s/article/K000161584'
    label: f5sirt@f5.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:27197'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:36331'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:36364'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:36618'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:36639'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:38847'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:44481'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:46836'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:58981'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/security/cve/CVE-2026-42055'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2489866'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42055.json
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
tags:
  - nvd
  - cve.org
  - exploit-available
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-06-17T00:00:00+00:00'
epss: 0.02355
epssPercentile: 0.83021
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/HORKimhab/CVE-2026-42055'
  checkedAt: '2026-09-26T09:05:43.682Z'
exploitAvailable: true
ingestedAt: '2026-07-03T13:02:27.787Z'
---

## Overview

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability exists when the proxy_http_version to 2 or grpc_pass directives are used to proxy HTTP/2 traffic, the ignore_invalid_headers directive is set to off, and the large_client_header_buffers directive size is larger than 2 megabytes. A remote, unauthenticated attacker, along with conditions beyond their control, could send large headers while creating an upstream request. This may cause a heap-based buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. 


Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

## Affected

- `dos >= 4.3.0, <= 4.7.0`
- `dos = 4.9.0`
- `nginx_gateway_fabric >= 1.3.0, <= 1.6.2`
- `nginx_gateway_fabric >= 2.0.0, <= 2.6.3`
- `nginx_ingress_controller >= 3.5.0, <= 3.7.2`
- `nginx_ingress_controller >= 4.0.0, <= 4.0.1`
- `nginx_ingress_controller >= 5.0.0, <= 5.5.0`
- `nginx_instance_manager >= 2.17.0, <= 2.22.0`
- `nginx_open_source >= 1.0.0, <= 1.30.2`
- `nginx_open_source >= 1.31.0, <= 1.31.1`
- `nginx_plus >= 37.0.0.1, < 37.0.2.1`
- `nginx_plus >= r33, < r36`
- `nginx_plus = r36`
- `waf >= 4.10.0, <= 4.16.0`
- `waf >= 5.2.0, <= 5.8.0`
- `waf >= 5.9.0, <= 5.13.1`
- `discovery`
- `hardened_images`
- `update_infrastructure >= 5.0, < 5.2`
- `enterprise_linux = 8.0`
- `enterprise_linux = 9.0`
- `enterprise_linux = 10.0`

## Remediation

Upgrade past the affected range:

- `nginx_plus r36`
- `update_infrastructure 5.2`