Description
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability exists when the proxy_http_version to 2 or grpc_pass directives are used to proxy HTTP/2 traffic, the ignore_invalid_headers directive is set to off, and the large_client_header_buffers directive size is larger than 2 megabytes. A remote, unauthenticated attacker, along with conditions beyond their control, could send large headers while creating an upstream request. This may cause a heap-based buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| F5 | NGINX Open Source | 1.13.10 – < 1.31.2, 1.30.2 – < 1.30.3 | 1.31.2 |
| F5 | NGINX Plus | 37.0 – < 37.0.2.1, R36 – < R36 P6 | 37.0.2.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nginx | 1.30.1-5 | — |
| Debian 13 | nginx | 1.26.3-3+deb13u7 | — |
| Debian 12 | nginx | 1.22.1-9+deb12u9 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | nginx | 1.28.3-2ubuntu1.6 | — |
| Ubuntu 25.10 | nginx | 1.28.0-6ubuntu1.8 | — |
| Ubuntu 24.04 LTS | nginx | 1.24.0-2ubuntu7.13 | — |
| Ubuntu 22.04 LTS | nginx | 1.18.0-6ubuntu14.16 | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | nginx | No fix yet | — |
| Ubuntu Pro 18.04 LTS | nginx | No fix yet | — |
| Ubuntu Pro 16.04 LTS | nginx | No fix yet | — |
| Ubuntu Pro 14.04 LTS | nginx | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | nginx +9 | 2:1.26.3-6.el10_2.5 | RHSA-2026:36364 |
| RHEL 9 | nginx +9 | 1:1.24.0-7.module+el9.8.0+24502+c9b9ab67.3 | RHSA-2026:36639, RHSA-2026:36618, RHSA-2026:36331 |
| RHEL 8 | nginx +8 | 1:1.24.0-3.module+el8.10.0+24503+61c7c092.3 | RHSA-2026:38847 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.6 EUS | nginx +9 | 2:1.20.1-22.el9_6.7 | RHSA-2026:93467 |
| RHEL 9.4 E4S | nginx +8 | 1:1.20.1-16.el9_4.7 | RHSA-2026:93468 |
| RHEL 9.2 E4S | nginx +8 | 1:1.20.1-14.el9_2.7 | RHSA-2026:93472 |
| Red Hat Hardened Images 1 | nginx +11 | 1.30.3-2.hum1 | RHSA-2026:27197 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | nginx +9 | 2:1.26.3-6.el10_2.5 | ALSA-2026:36364 |
| AlmaLinux 9 | nginx +9 | 1:1.24.0-7.module_el9.8.0+278+b57266e8.3.alma.1 | ALSA-2026:36639, ALSA-2026:36618, ALSA-2026:36331 |
| AlmaLinux 8 | nginx +8 | 1:1.24.0-3.module_el8.10.0+4215+c88f2fa5.3.alma.1 | ALSA-2026:38847 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | nginx | 2:1.26.3-6.el10_2.5 | RLSA-2026:36364 |
| Rocky Linux 9 | nginx | 1:1.24.0-7.module+el9.8.0+40193+7b2d11e4.1.rocky.0.1 | RLSA-2026:36639, RLSA-2026:36618, RLSA-2026:36331 |
| Rocky Linux 8 | nginx | 1:1.24.0-3.module+el8.10.0+40144+38158758 | RLSA-2026:38847 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | nginx | 1.21.5-150600.10.24.1 | SUSE-SU-2026:3329-1 |
| SLES 15 SP6 | nginx | 1.21.5-150600.10.24.1 | SUSE-SU-2026:3329-1 |
| SLES 15 SP5 | nginx | 1.21.5-150400.3.25.1 | SUSE-SU-2026:3448-1 |
| SLES 15 SP4 | nginx | 1.21.5-150400.3.25.1 | SUSE-SU-2026:3448-1 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | nginx | 1.27.2-160000.6.1 | SUSE-SU-2026:22951-1, SUSE-SU-2026:22943-1 |
| SLES for SAP 15 SP6 | nginx | 1.21.5-150600.10.24.1 | SUSE-SU-2026:3329-1 |
| SLES for SAP 15 SP5 | nginx | 1.21.5-150400.3.25.1 | SUSE-SU-2026:3448-1 |
| SLES for SAP 15 SP4 | nginx | 1.21.5-150400.3.25.1 | SUSE-SU-2026:3448-1 |
| SLES 16.0 | nginx | 1.27.2-160000.6.1 | SUSE-SU-2026:22951-1, SUSE-SU-2026:22943-1 |
| SLE HPC 15 SP5 | nginx | 1.21.5-150400.3.25.1 | SUSE-SU-2026:3448-1 |
| SLE HPC 15 SP4 | nginx | 1.21.5-150400.3.25.1 | SUSE-SU-2026:3448-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | nginx | 1.31.2-1.1 | openSUSE-SU-2026:11066-1 |
| openSUSE Leap 16.0 | nginx | 1.27.2-160000.6.1 | openSUSE-SU-2026:21439-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | nginx | 1.30.3-r0 | — |
| Alpine v3.23 | nginx | 1.28.3-r4 | — |
| Alpine v3.22 | nginx | 1.28.3-r4 | — |
| Alpine v3.21 | nginx | 1.26.3-r2 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | nginx +9 | 1:1.30.3-1.amzn2023.0.1 | ALAS2023-2026-1922 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | nginx | 1.28.3-8 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | nginx +9 | 2:1.26.3-6.0.1.el10_2.5 | ELSA-2026-36364 |
| Oracle Linux 9 | nginx +9 | 1:1.24.0-7.0.1.module+el9.8.0+90951+a848b39d.3 | ELSA-2026-36639, ELSA-2026-36618, ELSA-2026-36331 |
| Oracle Linux 8 | nginx +8 | 1:1.24.0-3.0.1.module+el8.10.0+90952+25c71254.3 | ELSA-2026-38847 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | ingress-nginx-controller-1.15 | 1.15.8-r0 | — |
| Wolfi rolling | nginx-mainline | 1.31.2-r0 | — |
| Wolfi rolling | nginx-stable +16 | 1.30.3-r0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
HORKimhab/CVE-2026-42055 ★ 0 · Jun 19, 2026
CVE-2026-42055 - Draft
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 32
- RHSA-2026:93467 Red Hat Security Advisory: nginx security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:93468 Red Hat Security Advisory: nginx security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:93472 Red Hat Security Advisory: nginx security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- WID-SEC-2026-1995 NGINX und NGINX Plus: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 1, 2026
- ALSA-2026:36331 Important: nginx security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:36618 Important: nginx:1.24 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:36639 Important: nginx:1.26 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:36364 Important: nginx security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:38847 Important: nginx:1.24 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:27197 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2026:38847 Red Hat Security Advisory: nginx:1.24 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Sep 12, 2026
- RHSA-2026:36639 Red Hat Security Advisory: nginx:1.26 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Sep 12, 2026
- RHSA-2026:36618 Red Hat Security Advisory: nginx:1.24 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Sep 12, 2026
- RHSA-2026:36364 Red Hat Security Advisory: nginx security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Sep 12, 2026
- RHSA-2026:36331 Red Hat Security Advisory: nginx security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Sep 12, 2026
- SUSE-SU-2026:3448-1 Security update for nginx SUSE / openSUSE Security Updates · Aug 4, 2026
- RLSA-2026:36331 Important: nginx security, bug fix, and enhancement update Rocky Linux Security Advisories · Jul 29, 2026
- SUSE-SU-2026:3329-1 Security update for nginx SUSE / openSUSE Security Updates · Jul 29, 2026
- SUSE-SU-2026:22951-1 Security update for nginx SUSE / openSUSE Security Updates · Jul 29, 2026
- SUSE-SU-2026:22943-1 Security update for nginx SUSE / openSUSE Security Updates · Jul 29, 2026
- openSUSE-SU-2026:21439-1 Security update for nginx SUSE / openSUSE Security Updates · Jul 26, 2026
- ELSA-2026-36364 Important: nginx security, bug fix, and enhancement update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 16, 2026
- ELSA-2026-38847 Important: nginx:1.24 security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jul 14, 2026
- RLSA-2026:38847 Important: nginx:1.24 security, bug fix, and enhancement update Rocky Linux Security Advisories · Jul 13, 2026
- ELSA-2026-36331 Important: nginx security, bug fix, and enhancement update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jul 13, 2026
- ELSA-2026-36639 Important: nginx:1.26 security, bug fix, and enhancement update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jul 9, 2026
- ELSA-2026-36618 Important: nginx:1.24 security, bug fix, and enhancement update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jul 9, 2026
- RLSA-2026:36639 Important: nginx:1.26 security, bug fix, and enhancement update Rocky Linux Security Advisories · Jul 8, 2026
- RLSA-2026:36364 Important: nginx security, bug fix, and enhancement update Rocky Linux Security Advisories · Jul 8, 2026
- RLSA-2026:36618 Important: nginx:1.24 security, bug fix, and enhancement update Rocky Linux Security Advisories · Jul 8, 2026
- ALAS2023-2026-1922 Important: nginx security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jul 7, 2026
- openSUSE-SU-2026:11066-1 nginx-1.31.2-1.1 on GA media SUSE / openSUSE Security Updates · Jun 20, 2026
References
- https://my.f5.com/manage/s/article/K000161584 vendor-advisory