HTTP/2 Traffic Injection Vulnerability in NGINX Open Source by F5 Networks
CVE-2026-42926

6.3MEDIUM

Key Information:

Vendor

F5
Status
Nginx Open Source
Vendor
CVE Published:
13 May 2026

What is CVE-2026-42926?

A vulnerability exists in NGINX Open Source when configured to proxy HTTP/2 traffic using the proxy_http_version set to 2 in conjunction with proxy_set_body. An attacker could exploit this configuration to inject frame headers and payload bytes directed at the upstream server, potentially leading to unauthorized access or data manipulation. Software versions that have reached End of Technical Support are excluded from evaluation.

Affected Version(s)

NGINX Open Source 1.29.4 < 1.30.1

NGINX Open Source 1.31.0

References

https://my.f5.com/manage/s/article/K000161131
vendor-advisorypatch

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

F5 acknowledges Mufeed VH of Winfunc Research and Hcamael of aipyaipy for bringing this issue to our attention and following the highest standards of coordinated disclosure.
.