HTTP/2 Traffic Injection Vulnerability in NGINX Open Source by F5 Networks
CVE-2026-42926

6.3MEDIUM

Key Information:

Vendor

F5
Status
Nginx Open Source
Vendor
CVE Published:
13 May 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-42926?

A vulnerability exists in NGINX Open Source when configured to proxy HTTP/2 traffic using the proxy_http_version set to 2 in conjunction with proxy_set_body. An attacker could exploit this configuration to inject frame headers and payload bytes directed at the upstream server, potentially leading to unauthorized access or data manipulation. Software versions that have reached End of Technical Support are excluded from evaluation.

Affected Version(s)

NGINX Open Source 1.29.4 < 1.30.1

NGINX Open Source 1.31.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE2026-42926
Created by ikarolaborda

References

https://my.f5.com/manage/s/article/K000161131
vendor-advisorypatch

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

F5 acknowledges Mufeed VH of Winfunc Research and Hcamael of aipyaipy for bringing this issue to our attention and following the highest standards of coordinated disclosure.
.