---
id: CVE-2026-55233
title: OpenResty is a high performance web platform
summary: >-
  OpenResty is a high performance web platform. From 1.29.2.1 to before
  1.29.2.5, an out-of-bounds write vulnerability exists in the upstream PROXY
  protocol v2 implementation. When OpenResty is configured to send PROXY
  protocol version 2 h…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-787
published: '2026-07-10'
updated: '2026-07-10'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-55233'
references:
  - url: >-
      https://github.com/openresty/openresty/commit/5c56ad2958a2dad8b2cc99f4987b8642cbc647d1
    label: security-advisories@github.com
  - url: >-
      https://github.com/openresty/openresty/security/advisories/GHSA-wx83-v28q-68gx
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00488
epssPercentile: 0.41107
ingestedAt: '2026-07-11T20:15:26.905Z'
---

## Overview

OpenResty is a high performance web platform. From 1.29.2.1 to before 1.29.2.5, an out-of-bounds write vulnerability exists in the upstream PROXY protocol v2 implementation. When OpenResty is configured to send PROXY protocol version 2 headers to upstream servers, constructing the header in the stream proxy protocol v2 patch can write beyond the bounds of the allocated buffer, causing the worker process to crash and resulting in a denial of service. Only configurations that explicitly enable PROXY protocol v2 for upstream connections are impacted. This issue is fixed in version 1.29.2.5.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.