CVE-2026-42055: 
NGINX vulnerability analysis and mitigation

CVE-2026-42055 is a heap-based buffer overflow vulnerability in NGINX Plus and NGINX Open Source affecting the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. It was published on June 17, 2026, and affects NGINX Open Source versions 1.13.10 through 1.31.2 (exclusive) and 1.30.2 through 1.30.3 (exclusive), as well as NGINX Plus R36 through R36 P6 and 37.0 through 37.0.2.1. The vulnerability carries a CVSS v3.1 score of 8.1 (High) and a CVSS v4.0 score of 9.2 (Critical) (GitHub Advisory, F5 Advisory).

The vulnerability is classified as CWE-122 (Heap-based Buffer Overflow) and is triggered under a specific combination of configuration conditions: the proxy_http_version 2 or grpc_pass directives must be active to proxy HTTP/2 traffic, the ignore_invalid_headers directive must be set to off, and the large_client_header_buffers directive size must be configured larger than 2 megabytes. When these conditions are met, a remote unauthenticated attacker can send oversized headers during upstream request creation, causing a heap overflow in the NGINX worker process. Code execution is possible on systems where ASLR is disabled or can be bypassed; otherwise, the primary impact is a worker process crash and restart (GitHub Advisory, F5 Advisory).

Successful exploitation can cause the NGINX worker process to crash and restart, resulting in a denial of service for active connections. On systems where ASLR is disabled or can be bypassed by the attacker, arbitrary code execution is possible with the privileges of the NGINX worker process, potentially leading to full system compromise, data exfiltration, and lateral movement within the network. The vulnerability affects confidentiality, integrity, and availability at the highest level under code execution conditions (GitHub Advisory, F5 Advisory).

1. Reconnaissance: Identify NGINX instances running vulnerable versions (Open Source 1.13.10–<1.31.2 or 1.30.2–<1.30.3; Plus R36–<R36 P6 or 37.0–<37.0.2.1) using tools like Shodan, Censys, or banner grabbing. Determine if the target is configured to proxy HTTP/2 traffic via proxy_http_version 2 or grpc_pass.
2. Configuration verification: Confirm that the target NGINX instance has ignore_invalid_headers off and large_client_header_buffers set to a size greater than 2 MB — these are non-default settings that must be present for the vulnerability to be exploitable.
3. Craft oversized header payload: Construct an HTTP/2 request containing abnormally large headers (exceeding the buffer allocation threshold) designed to overflow the heap buffer in the NGINX worker process during upstream request creation.
4. Send malicious request: Transmit the crafted HTTP/2 request to the vulnerable NGINX endpoint. On a standard ASLR-enabled system, this will cause the worker process to crash and restart (DoS).
5. Achieve code execution (ASLR-disabled targets): On systems where ASLR is disabled or can be bypassed (e.g., via information leak), craft the heap overflow payload to redirect execution flow to attacker-controlled shellcode or a ROP chain, achieving arbitrary code execution as the NGINX worker process user (GitHub Advisory, F5 Advisory).

• Logs: Repeated NGINX worker process crash/restart entries in system logs (e.g., nginx: worker process ... exited on signal 11 in /var/log/nginx/error.log or syslog); unusual upstream request errors coinciding with large header sizes.
• Network: HTTP/2 requests with abnormally large header blocks (>2 MB) directed at NGINX reverse proxy or gRPC endpoints; unexpected outbound connections from the NGINX worker process to external IPs (indicative of post-exploitation).
• Process: Unexpected child processes spawned by the NGINX worker (e.g., shells, curl, wget); NGINX worker process consuming abnormal memory before crashing.
• File System: New or modified files in web root or NGINX configuration directories created by the NGINX worker process user; unexpected cron jobs or scheduled tasks added under the NGINX service account.

F5 has released patched versions: NGINX Open Source 1.31.2 (mainline) and 1.30.3 (stable), and NGINX Plus R36 P6 and 37.0.2.1. Upgrading to these versions is the recommended remediation (F5 Advisory). As temporary workarounds, administrators can: (1) disable HTTP/2 proxying by removing proxy_http_version 2 and grpc_pass directives; (2) set ignore_invalid_headers on (the default); or (3) reduce large_client_header_buffers size to 2 MB or smaller. Ensuring ASLR is enabled on the host OS provides partial protection against code execution exploitation but does not prevent the DoS condition.

F5 issued an out-of-band security advisory (K000161584) for this vulnerability, reflecting the severity of the issue (F5 Advisory). BleepingComputer and The Hacker News both covered the disclosure, noting F5's emergency patching effort for critical NGINX flaws (BleepingComputer, The Hacker News). SecurityWeek highlighted the critical and high severity nature of the NGINX vulnerabilities patched in this release (SecurityWeek). Community discussion on Reddit's CVEWatch subreddit listed CVE-2026-42055 among the top trending CVEs for the week of June 20, 2026, reflecting broad awareness in the security community.