CVE-2026-42055: NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability
NGINX ngxhttpproxyv2module and ngxhttpgrpcmodule vulnerability
Other sources
NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpproxyv2module and ngxhttpgrpcmodule modules. This vulnerability exists when the proxyhttpversion to 2 or grpcpass directives are used to proxy HTTP/2 traffic, the ignoreinvalidheaders directive is set to off, and the largeclientheaderbuffers directive size is larger than 2 megabytes. A remote, unauthenticated attacker, along with conditions beyond their control, could send large headers while creating an upstream request. This may cause a heap-based buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.28.3-7 - Configuration
Set the ignore_invalid_headers directive to an appropriate value to avoid the vulnerable condition where ignore_invalid_headers is set to off (required for the heap-based buffer overflow trigger described for ngx_http_proxy_v2_module and ngx_http_grpc_module).
NGINX ngx_http_proxy_v2_module / ngx_http_grpc_module ignore_invalid_headers = off - Configuration
Reduce the large_client_header_buffers directive size so it is not larger than 2 megabytes, since the vulnerability exists when large_client_header_buffers is larger than 2 megabytes.
NGINX ngx_http_proxy_v2_module / ngx_http_grpc_module large_client_header_buffers = <= 2 megabytes
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42055?
The severity of CVE-2026-42055 is critical with a CVSS score of 9.2.
What systems are affected by CVE-2026-42055?
CVE-2026-42055 affects NGINX Plus and NGINX Open Source when using ngx_http_proxy_v2_module and ngx_http_grpc_module.
How do I fix CVE-2026-42055?
To fix CVE-2026-42055, apply the latest patches provided by NGINX for the affected modules.
What type of vulnerability is CVE-2026-42055?
CVE-2026-42055 is classified as a buffer overflow vulnerability.
What configurations trigger CVE-2026-42055?
CVE-2026-42055 is triggered when proxy_http_version is set to 2 or grpc_pass directives are used with the ignore_invalid_headers directive set to off.