CVE-2026-42055

Name of the Vulnerable Software and Affected Versions NGINX Plus (affected versions not specified) NGINX Open Source (affected versions not specified)

Description A flaw in the ngx http proxy v2 module and ngx http grpc module modules can be triggered when NGINX is configured to proxy HTTP/2 traffic using the proxy http version set to 2 or the grpc pass directives, while the ignore invalid headers directive is set to off and the large client header buffers directive is larger than 2 megabytes. A remote, unauthenticated attacker can send specially crafted large headers during an upstream request, causing a heap-based buffer overflow in the NGINX worker process. This can lead to a Denial of Service (DoS) via a process restart or potentially allow arbitrary code execution on systems where Address Space Layout Randomization (ASLR)—a security technique that randomizes memory addresses to prevent exploitation—is disabled or bypassed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, set the ignore invalid headers directive to on or ensure the large client header buffers directive is set to 2 megabytes or less.