Brief Summary: CVE-2026-42055 Heap Buffer Overflow in NGINX HTTP/2 Proxy and gRPC Modules

Introduction

An unauthenticated remote attacker can trigger a heap buffer overflow in NGINX's HTTP/2 proxy and gRPC modules by sending oversized headers. The overflow crashes worker processes and, on systems without ASLR, can lead to code execution. NGINX runs 32.8% of all websites and roughly 4.6 million active domains, so any exploitable flaw in its proxy pipeline has a large potential blast radius. The exposure is greatest for organizations running API gateways and microservices architectures that rely on HTTP/2 upstream proxying.

CVE-2026-42055 lands while NGINX's HTTP/2 implementation is already under scrutiny. The closely related CVE-2026-42945 ("NGINX Rift") was weaponized quickly after disclosure, and this new vulnerability shares its CWE classification, its vendor, and a similar attack surface. Exploitation requires a specific combination of three non-default configuration directives. Deployments that meet those criteria, though, are often high-value targets: gRPC proxies, service meshes, and HTTP/2 reverse proxies sitting in front of critical backend infrastructure.

Technical Information

Vulnerability Classification

CVE-2026-42055 is classified under CWE-122 (Heap-based Buffer Overflow). The NVD has assigned two CVSS scores:

The CVSS v4.0 vector string is CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. It describes a network-accessible vulnerability with high attack complexity. No privileges or user interaction are required, and the impact on the confidentiality, integrity, and availability of the vulnerable system can be high.

Affected Modules and Root Cause

The vulnerability is in two NGINX modules, ngx_http_proxy_v2_module and ngx_http_grpc_module, both of which proxy HTTP/2 traffic to upstream servers. The fault is in the buffer allocation logic. When NGINX constructs an upstream HTTP/2 request, the allocation does not correctly account for the full size of the incoming headers. If those headers are large enough (which the configuration conditions below make possible), the write runs past the allocated heap buffer and corrupts adjacent memory in the NGINX worker process.

Required Configuration Conditions

The vulnerability is exploitable only when all three of these non-default configuration conditions are present in the same location block:

1. The proxy_http_version directive is set to 2, or the grpc_pass directive is used to proxy gRPC traffic over HTTP/2.
2. The ignore_invalid_headers directive is set to off, so NGINX accepts and processes headers it would otherwise reject as malformed.
3. The large_client_header_buffers directive is configured with a per-buffer size above 2 megabytes.

All three conditions deviate from NGINX defaults, so the vulnerable configuration surface is narrower than the full install base. Deployments that proxy HTTP/2 or gRPC traffic to upstream backends are more likely to have these settings in place, particularly in API gateway and microservices environments.

Attack Flow

Exploitation follows these steps:

1. The attacker identifies an NGINX instance that meets all three configuration conditions, possibly through header size probing or configuration disclosure.
2. The attacker sends an HTTP request with extremely large headers to a location block configured for HTTP/2 proxying.
3. Because ignore_invalid_headers is set to off, NGINX accepts and processes the oversized headers instead of rejecting them at the parsing stage.
4. The large_client_header_buffers setting (above 2 MB) gives NGINX enough memory to receive the incoming headers on the client side.
5. NGINX constructs the upstream HTTP/2 request through the proxy_v2 or gRPC module, but the buffer allocated for the outbound request does not account for the full header size. The module writes past the end of the allocated heap buffer.
6. The heap corruption affects adjacent memory in the NGINX worker process.

The F5 advisory refers to "conditions beyond their control," meaning the attacker cannot guarantee success on every attempt. Whether the overflow produces a simple crash or a controllable memory write depends on the heap layout and internal state of the worker process at that moment.

Impact Analysis

Denial of Service: The immediate and most reliable impact is a worker process crash and restart. NGINX's multi-worker architecture limits the damage from a single worker crash, but repeated exploitation can degrade service persistently across all workers.

Remote Code Execution: The more severe outcome is arbitrary code execution, which is achievable when:

• Address Space Layout Randomization (ASLR) is disabled on the host system, so the attacker can predict memory addresses.
• The attacker can bypass ASLR through a separate information leak vulnerability or a side-channel attack.

On systems with ASLR enabled and no bypass available, code execution is much harder but not impossible, because heap corruption can still support probabilistic exploitation.

Relationship to CVE-2026-42926

CVE-2026-42055 is closely related to CVE-2026-42926, another vulnerability in the ngx_http_proxy_v2_module. CVE-2026-42926 (CVSS v3.1: 5.8, CVSS v4.0: 6.3) lets a remote unauthenticated attacker inject arbitrary HTTP/2 frame headers and payload bytes into the upstream connection when NGINX is configured with proxy_set_body and proxy_http_version set to 2. The injection can desynchronize NGINX and the upstream HTTP/2 peer. Both CVEs affect the same module and share the HTTP/2 proxy attack surface, but CVE-2026-42055 is more severe because of its code execution potential. Organizations should fix both vulnerabilities together.

Affected Systems and Versions

According to the F5 advisory (K000161584), these products and versions are affected:

Vulnerable configuration requirements (all three must be present at the same time):

• proxy_http_version 2 or grpc_pass directive in use
• ignore_invalid_headers off
• large_client_header_buffers with a per-buffer size exceeding 2 megabytes

F5 does not evaluate software versions that have reached End of Technical Support (EoTS), and those versions may remain vulnerable. Organizations running EoTS versions should upgrade to a supported branch.

Vendor Security History

NGINX vulnerabilities clustered heavily in the 2025 to 2026 period, particularly in HTTP/2 and proxy-related modules:

NGINX has historically had relatively few critical-severity vulnerabilities. The closest parallels are the 2014 SPDY vulnerabilities (CVE-2014-0133, CVE-2014-0088) and the 2013 stack buffer overflow (CVE-2013-2028). The current cluster of HTTP/2 proxy findings suggests this part of the codebase has become a productive target for security researchers. F5 has been responsive in issuing advisories and patches. Still, the volume of recent findings raises questions about how deep the security review of the original HTTP/2 proxy implementation went.

CVE-2026-42945 ("NGINX Rift") is the biggest concern on this list, because it was confirmed as actively exploited shortly after disclosure. SecurityWeek reported rapid weaponization, and the CSA Singapore advisory confirmed both active exploitation and proof-of-concept availability. Proofpoint's May 2026 threat intelligence report identifies 12 distinct 2026 CVEs being actively exploited in network-facing attacks. Threat actors including TA422 (Russia-linked, APT28), TA406 (DPRK-aligned), and TA569 (SocGholish) have all made opportunistic use of public proof-of-concept code. CVE-2026-42055 has not yet been observed in active exploitation, but the pattern set by CVE-2026-42945 suggests the window between disclosure and weaponization is narrowing.

References

• NVD: CVE-2026-42055
• F5 Advisory K000161584: NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability CVE-2026-42055
• F5 Advisory K000161131: NGINX ngx_http_proxy_v2_module vulnerability CVE-2026-42926
• F5 Advisory K000161019: NGINX ngx_http_rewrite_module vulnerability CVE-2026-42945
• NGINX Official Security Advisories
• CSA Singapore: Multiple Vulnerabilities in F5 NGINX, BIG-IP and BIG-IQ
• SecurityWeek: Exploitation of Critical NGINX Vulnerability Begins
• Proofpoint: 2026 Vulnerability Exploitation in the Wild
• Radware: AI-Discovered HTTP/2 Bomb Affects Major Web Servers
• runZero: F5 NGINX Vulnerability: Find Impacted Systems
• NVD: CVE-2026-42945
• TechnologyChecker: Companies Using NGINX in 2026