High 8.1Published Jun 17, 2026

CVE-2026-42055NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability

Updated under an hour ago (Oct 27, 2026, 11:50 PM ET)

Does this affect you?

It affects F5 NGINX Open Source and 13 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for F5 NGINX Open Source

Exploited in the last 30 days

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability exists when the proxy_http_version to 2 or grpc_pass directives are used to proxy HTTP/2 traffic, the ignore_invalid_headers directive is set to off, and the large_client_header_buffers directive size is larger than 2 megabytes. A remote, unauthenticated attacker, along with conditions beyond their control, could send large headers while creating an upstream request. This may cause a heap-based buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS: 8.1 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-122, CWE-131
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: f5
NVD analysis: Modified
Record last updated: Sep 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

F5 NGINX Open Source f5:nginx_open_source (from the name)	from 1.13.10 before 1.31.2; from 1.30.2 before 1.30.3	CNA record
F5 NGINX Plus f5:nginx_plus (from the name)	from 37.0 before 37.0.2.1; from R36 before R36 P6	CNA record
Red Hat Red Hat Enterprise Linux 10 redhat:enterprise_linux	from 2:1.26.3-6.el10_2.5 not affected	CISA ADP
Red Hat Red Hat Discovery 2 redhat:discovery	from 1784821750 not affected	CISA ADP
Red Hat Red Hat Hardened Images redhat:hummingbird	from 1.30.3-2.hum1 not affected	CISA ADP
Red Hat Red Hat Update Infrastructure 5 redhat:rhui	from 1784794818 not affected	CISA ADP
Red Hat Red Hat Openshift Data Foundation 4 redhat:openshift_data_foundation	4	CISA ADP
f5 dos f5:dos	from 4.3.0 through 4.7.0; 4.9.0	NVD
f5 nginx_gateway_fabric f5:nginx_gateway_fabric	from 1.3.0 through 1.6.2; from 2.0.0 through 2.6.3	NVD
f5 nginx_ingress_controller f5:nginx_ingress_controller	from 3.5.0 through 3.7.2; from 4.0.0 through 4.0.1; from 5.0.0 through 5.5.0	NVD
1–10 of 18

References

References

https://my.f5.com/manage/s/article/K000161584	vendor-advisory
https://access.redhat.com/errata/RHSA-2026:27197	third-party-advisory
https://access.redhat.com/errata/RHSA-2026:36331	third-party-advisory
https://access.redhat.com/errata/RHSA-2026:36364	third-party-advisory
https://access.redhat.com/errata/RHSA-2026:36618	third-party-advisory
https://access.redhat.com/errata/RHSA-2026:36639	third-party-advisory
https://access.redhat.com/errata/RHSA-2026:38847	third-party-advisory
https://access.redhat.com/errata/RHSA-2026:44481	third-party-advisory
https://access.redhat.com/errata/RHSA-2026:46836	third-party-advisory
https://access.redhat.com/errata/RHSA-2026:58981
1–10 of 13

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.