Heap-based buffer overflow in NGINX Plus and NGINX Open Source - CVE-2026-42055

Vulnerability identifier: #VU134861

CSH Severity: High

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-42055

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code or cause a denial of service.

The vulnerability exists due to heap-based buffer overflow in ngx_http_proxy_v2_module and ngx_http_grpc_module when proxying HTTP/2 traffic with large headers while creating an upstream request. A remote attacker can send large headers to execute arbitrary code or cause a denial of service.

Exploitation requires a non-default configuration in which proxy_http_version is set to 2 or grpc_pass is used, ignore_invalid_headers is set to off, and the large_client_header_buffers per-buffer size is larger than 2 megabytes. This is a data plane issue only.

NGINX Plus
NGINX Open Source
Debian Linux
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Server Applications Module
openSUSE Leap
openEuler
Anolis OS
Fedora
nginx-mod-js-challenge
nginx-mod-vts
nginx-mod-fancyindex
nginx-mod-headers-more
nginx-mod-brotli
nginx-mod-modsecurity
nginx-mod-naxsi
nginx-mod-stream
nginx
nginx-debuginfo
nginx-debugsource
nginx-mod-devel
nginx-mod-http-image-filter
nginx-mod-http-perl
nginx-mod-http-xslt-filter
nginx-mod-mail
nginx-all-modules
nginx-filesystem
nginx-help
nginx-source
compat-nginx-mod-http-image-filter
compat-nginx-debugsource
compat-nginx-debuginfo
compat-nginx
compat-nginx-mod-http-xslt-filter
compat-nginx-all-modules
compat-nginx-filesystem
compat-nginx-help
compat-nginx-mod-stream
compat-nginx-mod-mail
compat-nginx-mod-http-perl
nginx (Debian package)
nginx (Red Hat package)
nginx-doc
nginx-core

Install security update from vendor's website.

NGINX Plus - addressed in versions R36 P6, 37.0.2.1
NGINX Open Source - addressed in versions 1.30.3, 1.31.2
nginx-mod-js-challenge - addressed in versions 0^20230517.gitda6852d-9.fc44, 0^20230517.gitda6852d-9.fc45
nginx-mod-vts - addressed in versions 0.2.4-11.fc43, 0.2.4-11.fc44, 0.2.4-11.fc45
nginx-mod-fancyindex - addressed in versions 0.6.0-6.fc43, 0.6.0-6.fc44, 0.6.0-6.fc45
nginx-mod-headers-more - addressed in versions 0.39-11.fc43, 0.39-11.fc44, 0.39-11.fc45
nginx-mod-brotli - addressed in versions 1.0.0~rc-11.fc43, 1.0.0~rc-11.fc44, 1.0.0~rc-11.fc45
nginx-mod-modsecurity - addressed in versions 1.0.4-12.fc43, 1.0.4-12.fc44, 1.0.4-12.fc45
nginx-mod-naxsi - addressed in versions 1.6-19.fc43, 1.6-19.fc44, 1.6-19.fc45
nginx-mod-stream - addressed in versions 1.21.5-15, 1.21.5-17, 1.24.0-13
nginx - addressed in versions 1.21.5-15, 1.21.5-17, 1.24.0-13
nginx-debuginfo - addressed in versions 1.21.5-15, 1.21.5-17, 1.24.0-13
nginx-debugsource - addressed in versions 1.21.5-15, 1.21.5-17, 1.24.0-13
nginx-mod-devel - addressed in versions 1.21.5-15, 1.21.5-17, 1.24.0-13
nginx-mod-http-image-filter - addressed in versions 1.21.5-15, 1.21.5-17, 1.24.0-13
nginx-mod-http-perl - addressed in versions 1.21.5-15, 1.21.5-17, 1.24.0-13
nginx-mod-http-xslt-filter - addressed in versions 1.21.5-15, 1.21.5-17, 1.24.0-13
nginx-mod-mail - addressed in versions 1.21.5-15, 1.21.5-17, 1.24.0-13
nginx-all-modules - addressed in versions 1.21.5-15, 1.21.5-17, 1.24.0-13
nginx-filesystem - addressed in versions 1.21.5-15, 1.21.5-17, 1.24.0-13
nginx-help - addressed in versions 1.21.5-17, 1.24.0-13
nginx-debugsource - update to 1.21.5-150600.10.24.1
nginx-debuginfo - update to 1.21.5-150600.10.24.1
nginx - update to 1.21.5-150600.10.24.1
nginx-source - update to 1.21.5-150600.10.24.1
compat-nginx-mod-http-image-filter - update to 1.24.0-13
compat-nginx-debugsource - update to 1.24.0-13
compat-nginx-debuginfo - update to 1.24.0-13
compat-nginx - update to 1.24.0-13
compat-nginx-mod-http-xslt-filter - update to 1.24.0-13
compat-nginx-all-modules - update to 1.24.0-13
compat-nginx-filesystem - update to 1.24.0-13
compat-nginx-help - update to 1.24.0-13
compat-nginx-mod-stream - update to 1.24.0-13
compat-nginx-mod-mail - update to 1.24.0-13
compat-nginx-mod-http-perl - update to 1.24.0-13
nginx (Debian package) - update to 1.26.3-3+deb13u7
nginx (Red Hat package) - update to 1.26.3-6.el10_2.5
nginx-mod-http-image-filter - update to 1.30.2-2
nginx-filesystem - update to 1.30.2-2
nginx-doc - update to 1.30.2-2
nginx-all-modules - update to 1.30.2-2
nginx-mod-stream - update to 1.30.2-2
nginx-mod-mail - update to 1.30.2-2
nginx-mod-http-xslt-filter - update to 1.30.2-2
nginx-mod-http-perl - update to 1.30.2-2
nginx-mod-devel - update to 1.30.2-2
nginx-core - update to 1.30.2-2
nginx - update to 1.30.2-2
nginx - addressed in versions 1.30.3-1.fc43, 1.30.3-1.fc44, 1.30.3-1.fc45

• https://my.f5.com/manage/s/article/K000161584

• Multiple vulnerabilities in NGINX
• Fedora 45 update for nginx, nginx-mod-brotli, nginx-mod-fancyindex, nginx-mod-headers-more, nginx-mod-js-challenge, nginx-mod-modsecurity, nginx-mod-naxsi, nginx-mod-vts
• Fedora 44 update for nginx, nginx-mod-brotli, nginx-mod-fancyindex, nginx-mod-headers-more, nginx-mod-js-challenge, nginx-mod-modsecurity, nginx-mod-naxsi, nginx-mod-vts
• Fedora 43 update for nginx, nginx-mod-brotli, nginx-mod-fancyindex, nginx-mod-headers-more, nginx-mod-modsecurity, nginx-mod-naxsi, nginx-mod-vts
• Debian update for nginx
• openEuler 24.03 LTS SP3 update for nginx
• openEuler 24.03 LTS SP1 update for nginx
• openEuler 22.03 LTS SP4 update for nginx
• openEuler 20.03 LTS SP4 update for nginx
• Red Hat Enterprise Linux 10 update for nginx
• Red Hat Enterprise Linux 8 update for the nginx:1.24 module
• Anolis OS update for nginx
• SUSE update for nginx