Heap-Based Buffer Overflow in NGINX Plus and Open Source Web Server
CVE-2026-42055

9.2CRITICAL

Key Information:

Vendor

F5
Status
Nginx Open Source
Nginx Plus
Vendor
CVE Published:
17 June 2026

Badges

๐Ÿ“ˆ Trended๐Ÿ“ˆ Score: 2,130๐Ÿ‘พ Exploit Exists๐ŸŸก Public PoC๐Ÿ“ฐ News Worthy

What is CVE-2026-42055?

CVE-2026-42055 is a critical vulnerability found in both NGINX Plus and NGINX Open Source, which are widely utilized web servers designed for handling high traffic and ensuring efficient content delivery. The vulnerability centers around a heap-based buffer overflow that can occur in specific modulesโ€”ngx_http_proxy_v2_module and ngx_http_grpc_moduleโ€”when certain conditions are met. Specifically, this issue arises when the proxy_http_version directive is set to 2 or the grpc_pass directive is in use, and the configuration allows for large client header buffers exceeding 2 megabytes while the ignore_invalid_headers directive is turned off.

If successfully exploited by a remote, unauthenticated attacker, the vulnerability can cause the NGINX worker process to crash, leading to service disruptions. More critically, in environments lacking Address Space Layout Randomization (ASLR) or where ASLR can be bypassed, attackers may gain the ability to execute arbitrary code on the affected systems. This provides fertile ground for further exploitation, including the potential for deploying malware or other malicious activities.

Potential impact of CVE-2026-42055

  1. Service Disruption: The vulnerability can lead to crashes of the NGINX worker processes, causing significant service interruptions. This can result in downtime for user-facing applications, leading to loss of business and customer trust.

  2. Remote Code Execution: Exploitation of this vulnerability may allow attackers to execute arbitrary code on the affected systems, especially in cases where ASLR is not properly implemented. This escalates the risk of full system compromise and unauthorized access to sensitive information.

  3. Increased Attack Surface: The nature of the vulnerability presents an opportunity for attackers to launch further attacks, such as deploying ransomware or other malware, particularly as proof-of-concept exploits may become available. This not only threatens the immediate system but can also put other connected systems and networks at risk.

Affected Version(s)

NGINX Open Source 1.13.10 < 1.31.2

NGINX Open Source 1.30.2 < 1.30.3

NGINX Plus 37.0 < 37.0.2.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-42055
Created by HORKimhab

News Articles

favicon imageTechtimes

NGINX Vulnerability Patch: F5 Fixes Critical HTTP/3 and HTTP/2 Remote Code Execution Flaws

NGINX vulnerability patch is now critical: F5โ€™s June 2026 out-of-band advisory covers two unauthenticated CVSS 9.2 flaws in HTTP/3 QUIC and HTTP/2 gRPC modules that can crash workers or enable remote

favicon imageThe Hacker News

F5 Patches Two Critical NGINX Open Source Flaws Enabling Remote Code Execution

F5 fixes CVE-2026-42530 and CVE-2026-42055 in NGINX Open Source, addressing HTTP/3 and HTTP/2 flaws that could allow remote code execution.

References

https://my.f5.com/manage/s/article/K000161584
vendor-advisory

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • ๐Ÿ“ˆ

    Vulnerability started trending

  • ๐ŸŸก

    Public PoC available

  • ๐Ÿ‘พ

    Exploit known to exist

  • ๐Ÿ“ฐ

    First article discovered by The Hacker News

  • Vulnerability published

  • Vulnerability Reserved

Credit

"F5 acknowledges Mufeed VH of Winfunc Research, Trung Nguyen (@everping) of CyStack, Feng Xue and XGPT of ThreatBook, Hcamael and ็ซ ้ฑผๅ“ฅ of aipyapp, and Zhen Yan (AntAISecurityLab) for bringing this issue to our attention and following the highest standards of coordinated disclosure."
.