CVE-2026-42055

Name of the Vulnerable Software and Affected Versions NGINX Plus (affected versions not specified) NGINX Open Source (affected versions not specified)

Description A flaw in the ngx http proxy v2 module and ngx http grpc module modules allows a remote, unauthenticated attacker to trigger a heap-based buffer overflow by sending specially crafted large headers during an upstream request. This occurs when the server is configured to proxy HTTP/2 traffic using the proxy http version set to 2 or the grpc pass directive, while the ignore invalid headers directive is set to off and the large client header buffers directive is larger than 2 megabytes. This can lead to a restart of the NGINX worker process, resulting in a Denial of Service (DoS). Furthermore, arbitrary code execution is possible on systems where Address Space Layout Randomization (ASLR)—a security technique that randomizes memory addresses to prevent exploitation—is disabled or bypassed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, set the ignore invalid headers directive to on or ensure the large client header buffers directive is set to 2 megabytes or less.