Heap-based buffer overflow in NGINX Open Source and NGINX Plus - CVE-2026-42055

Vulnerability identifier: #VU134861

CSH Severity: High

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-42055

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code or cause a denial of service.

The vulnerability exists due to heap-based buffer overflow in ngx_http_proxy_v2_module and ngx_http_grpc_module when proxying HTTP/2 traffic with large headers while creating an upstream request. A remote attacker can send large headers to execute arbitrary code or cause a denial of service.

Exploitation requires a non-default configuration in which proxy_http_version is set to 2 or grpc_pass is used, ignore_invalid_headers is set to off, and the large_client_header_buffers per-buffer size is larger than 2 megabytes. This is a data plane issue only.

NGINX Open Source
NGINX Plus
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP4
Gentoo Linux
Debian Linux
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Real Time 15
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Server Applications Module
openSUSE Leap
openEuler
Ubuntu
Anolis OS
Fedora
Netezza Appliance
nginx-light (Ubuntu package)
nginx-full (Ubuntu package)
nginx-extras (Ubuntu package)
nginx-core (Ubuntu package)
nginx (Ubuntu package)
nginx-mod-js-challenge
nginx-mod-vts
nginx-mod-fancyindex
nginx-mod-headers-more
nginx-mod-brotli
nginx-mod-modsecurity
nginx-mod-naxsi
nginx-debuginfo
nginx
nginx-all-modules
nginx-debugsource
nginx-mod-devel
nginx-mod-http-image-filter
nginx-mod-http-xslt-filter
nginx-mod-mail
nginx-mod-stream
nginx-mod-http-perl
nginx-filesystem
nginx-help
nginx-source
compat-nginx
compat-nginx-mod-stream
compat-nginx-mod-mail
compat-nginx-debuginfo
compat-nginx-all-modules
compat-nginx-filesystem
compat-nginx-help
compat-nginx-mod-http-xslt-filter
compat-nginx-mod-http-perl
compat-nginx-mod-http-image-filter
compat-nginx-debugsource
nginx (Red Hat package)
nginx-doc
nginx-core
www-servers/nginx
nginx (Debian package)

Install security update from vendor's website.

NGINX Open Source - addressed in versions 1.30.3, 1.31.2
NGINX Plus - addressed in versions R36 P6, 37.0.2.1
Netezza Appliance - update to 1.0.2.0
nginx-light (Ubuntu package) - addressed in versions 1.18.0-6ubuntu14.16, 1.24.0-2ubuntu7.13, 1.28.0-6ubuntu1.8, 1.28.3-2ubuntu1.6
nginx-full (Ubuntu package) - addressed in versions 1.18.0-6ubuntu14.16, 1.24.0-2ubuntu7.13, 1.28.0-6ubuntu1.8, 1.28.3-2ubuntu1.6
nginx-extras (Ubuntu package) - addressed in versions 1.18.0-6ubuntu14.16, 1.24.0-2ubuntu7.13, 1.28.0-6ubuntu1.8, 1.28.3-2ubuntu1.6
nginx-core (Ubuntu package) - addressed in versions 1.18.0-6ubuntu14.16, 1.24.0-2ubuntu7.13, 1.28.0-6ubuntu1.8, 1.28.3-2ubuntu1.6
nginx (Ubuntu package) - addressed in versions 1.18.0-6ubuntu14.16, 1.24.0-2ubuntu7.13, 1.28.0-6ubuntu1.8, 1.28.3-2ubuntu1.6
nginx-mod-js-challenge - addressed in versions 0^20230517.gitda6852d-9.fc44, 0^20230517.gitda6852d-9.fc45
nginx-mod-vts - addressed in versions 0.2.4-11.fc43, 0.2.4-11.fc44, 0.2.4-11.fc45
nginx-mod-fancyindex - addressed in versions 0.6.0-6.fc43, 0.6.0-6.fc44, 0.6.0-6.fc45
nginx-mod-headers-more - addressed in versions 0.39-11.fc43, 0.39-11.fc44, 0.39-11.fc45
nginx-mod-brotli - addressed in versions 1.0.0~rc-11.fc43, 1.0.0~rc-11.fc44, 1.0.0~rc-11.fc45
nginx-mod-modsecurity - addressed in versions 1.0.4-12.fc43, 1.0.4-12.fc44, 1.0.4-12.fc45
nginx-mod-naxsi - addressed in versions 1.6-19.fc43, 1.6-19.fc44, 1.6-19.fc45
nginx-debuginfo - addressed in versions 1.21.5-15, 1.21.5-17, 1.24.0-13
nginx - addressed in versions 1.21.5-15, 1.21.5-17, 1.24.0-13
nginx-all-modules - addressed in versions 1.21.5-15, 1.21.5-17, 1.24.0-13
nginx-debugsource - addressed in versions 1.21.5-15, 1.21.5-17, 1.24.0-13
nginx-mod-devel - addressed in versions 1.21.5-15, 1.21.5-17, 1.24.0-13
nginx-mod-http-image-filter - addressed in versions 1.21.5-15, 1.21.5-17, 1.24.0-13
nginx-mod-http-xslt-filter - addressed in versions 1.21.5-15, 1.21.5-17, 1.24.0-13
nginx-mod-mail - addressed in versions 1.21.5-15, 1.21.5-17, 1.24.0-13
nginx-mod-stream - addressed in versions 1.21.5-15, 1.21.5-17, 1.24.0-13
nginx-mod-http-perl - addressed in versions 1.21.5-15, 1.21.5-17, 1.24.0-13
nginx-filesystem - addressed in versions 1.21.5-15, 1.21.5-17, 1.24.0-13
nginx-help - addressed in versions 1.21.5-17, 1.24.0-13
nginx-debuginfo - addressed in versions 1.21.5-150400.3.25.1, 1.21.5-150600.10.24.1
nginx - addressed in versions 1.21.5-150400.3.25.1, 1.21.5-150600.10.24.1
nginx-debugsource - addressed in versions 1.21.5-150400.3.25.1, 1.21.5-150600.10.24.1
nginx-source - addressed in versions 1.21.5-150400.3.25.1, 1.21.5-150600.10.24.1
compat-nginx - update to 1.24.0-13
compat-nginx-mod-stream - update to 1.24.0-13
compat-nginx-mod-mail - update to 1.24.0-13
compat-nginx-debuginfo - update to 1.24.0-13
compat-nginx-all-modules - update to 1.24.0-13
compat-nginx-filesystem - update to 1.24.0-13
compat-nginx-help - update to 1.24.0-13
compat-nginx-mod-http-xslt-filter - update to 1.24.0-13
compat-nginx-mod-http-perl - update to 1.24.0-13
compat-nginx-mod-http-image-filter - update to 1.24.0-13
compat-nginx-debugsource - update to 1.24.0-13
nginx (Red Hat package) - update to 1.26.3-6.el10_2.5
nginx - update to 1.30.2-2
nginx-filesystem - update to 1.30.2-2
nginx-doc - update to 1.30.2-2
nginx-all-modules - update to 1.30.2-2
nginx-mod-mail - update to 1.30.2-2
nginx-mod-http-xslt-filter - update to 1.30.2-2
nginx-mod-http-perl - update to 1.30.2-2
nginx-mod-http-image-filter - update to 1.30.2-2
nginx-mod-devel - update to 1.30.2-2
nginx-core - update to 1.30.2-2
nginx-mod-stream - update to 1.30.2-2
nginx - addressed in versions 1.30.3-1.fc43, 1.30.3-1.fc44, 1.30.3-1.fc45
www-servers/nginx - update to 1.31.3-r1
nginx (Debian package) - update to 1.26.3-3+deb13u7

• https://my.f5.com/manage/s/article/K000161584

• Multiple vulnerabilities in NGINX
• Fedora 45 update for nginx, nginx-mod-brotli, nginx-mod-fancyindex, nginx-mod-headers-more, nginx-mod-js-challenge, nginx-mod-modsecurity, nginx-mod-naxsi, nginx-mod-vts
• Fedora 44 update for nginx, nginx-mod-brotli, nginx-mod-fancyindex, nginx-mod-headers-more, nginx-mod-js-challenge, nginx-mod-modsecurity, nginx-mod-naxsi, nginx-mod-vts
• Fedora 43 update for nginx, nginx-mod-brotli, nginx-mod-fancyindex, nginx-mod-headers-more, nginx-mod-modsecurity, nginx-mod-naxsi, nginx-mod-vts
• Debian update for nginx
• openEuler 24.03 LTS SP3 update for nginx
• openEuler 24.03 LTS SP1 update for nginx
• openEuler 22.03 LTS SP4 update for nginx
• openEuler 20.03 LTS SP4 update for nginx
• Red Hat Enterprise Linux 10 update for nginx
• Red Hat Enterprise Linux 8 update for the nginx:1.24 module
• Anolis OS update for nginx
• SUSE update for nginx
• SUSE update for nginx
• Gentoo update for nginx
• IBM Netezza Appliance update for NGINX
• Ubuntu update for nginx