CVE-2026-42926: NGINX ngx_http_proxy_v2_module vulnerability
When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxyhttpversion to 2, and also uses proxysetbody, an attacker may be able to inject frame headers and payload bytes to the upstream peer. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Do not use proxy_http_version set to 2 together with proxy_set_body on NGINX Open Source. Where both are configured, remove or change the configuration so the two directives are not used together (for example, remove proxy_set_body when proxy_http_version is 2, or otherwise ensure proxy_http_version is not 2 in that proxy configuration).
- Operational
Audit NGINX configurations for occurrences of the directives 'proxy_http_version 2' combined with any 'proxy_set_body' directive. For any matches, edit the configuration to remove the combination and reload/restart NGINX to apply the change.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42926?
CVE-2026-42926 has a high severity rating due to the potential for remote code execution via injected frame headers.
How do I fix CVE-2026-42926?
To fix CVE-2026-42926, it's recommended to update NGINX Open Source to the latest version that addresses this vulnerability.
What software is affected by CVE-2026-42926?
CVE-2026-42926 affects NGINX Open Source when configured to proxy HTTP/2 traffic using proxy_http_version set to 2.
Can CVE-2026-42926 be exploited remotely?
Yes, CVE-2026-42926 can be exploited remotely if an attacker can send specially crafted HTTP/2 requests.
What is the impact of CVE-2026-42926 on systems?
The impact of CVE-2026-42926 includes the potential for an attacker to inject malicious frame headers, compromising the upstream peer.