CVE-2026-42055: NGINX HTTP/2 Heap Buffer Overflow Vulnerability – Exploit & Remediation

Technical summary

The vulnerability exists in ngx_http_proxy_v2_module and ngx_http_grpc_module within NGINX implementations handling HTTP/2 traffic. It is a classic heap-based buffer overflow (CWE-787) stemming from improper buffer size calculations (CWE-131) and incorrect size validation (CWE-122). The flaw manifests when: (1) proxy_http_version is set to 2 or grpc_pass directive is active, (2) ignore_invalid_headers is off (meaning header validation is enforced), and (3) large_client_header_buffers is configured larger than 2MB. An attacker sends specially crafted HTTP/2 frames with large header data that overflow the heap buffer in the worker process. Code execution depends on memory layout predictability—feasible when ASLR is absent or can be bypassed through information disclosure or side-channel techniques.

Business impact

Organizations running NGINX Plus or NGINX Open Source as reverse proxies, API gateways, or ingress controllers face potential service disruption and data compromise. Worker process crashes cause temporary denial of service and connection resets, degrading availability. In environments without ASLR or with weak address randomization, attackers could achieve code execution, allowing lateral movement, data exfiltration, or system takeover. This is particularly concerning for companies using NGINX in Kubernetes ingress roles or as the frontline proxy for sensitive applications.

Affected systems

NGINX Plus (multiple versions) and NGINX Open Source are vulnerable. The affected product list also includes derivative and integrated products: NGINX App Protect WAF and DoS modules, NGINX Ingress Controller (multiple versions), NGINX Gateway Fabric, NGINX Instance Manager, and F5 DoS. Software versions at End of Technical Support (EoTS) are not evaluated per vendor policy. Organizations should consult F5's official advisory to identify precise affected versions and upgrade paths for their specific NGINX deployment.

Exploitability

Exploitation requires satisfying multiple conditions simultaneously, which raises the bar for opportunistic attacks but does not eliminate risk. An attacker must identify a target running NGINX with the precise configuration (proxy_http_version 2 or grpc_pass, ignore_invalid_headers off, large_client_header_buffers >2MB), craft HTTP/2 frames with oversized headers, and send them across the network. The attacker needs no authentication. While the CVSS vector (AC:H) reflects high attack complexity due to the configuration prerequisite, organized threat actors targeting critical infrastructure or specific organizations can probe for these settings and mount attacks. Code execution likelihood increases significantly without ASLR.

Remediation

Apply the security patch provided by F5/NGINX as soon as it becomes available. Verify the patch version against the official F5 advisory. Until patching is feasible, implement mitigations: (1) ensure ignore_invalid_headers is on (the default) to reject malformed headers before they reach the buffer; (2) reduce large_client_header_buffers to 2MB or smaller if your application permits; (3) disable HTTP/2 proxying or gRPC if not required; (4) implement rate limiting and request size limits at the network or WAF layer; (5) enable ASLR on all systems running NGINX worker processes to make code execution significantly harder.

Patch guidance

F5 will release patches across affected NGINX Plus and NGINX Open Source versions. Monitor F5's security advisory page and your NGINX deployment channels for patch announcements. Testing patches in a staging environment is critical before production rollout to ensure they do not interfere with legitimate HTTP/2 or gRPC traffic. If you use NGINX Ingress Controller, NGINX App Protect, or other integrated products, patch those components and the underlying NGINX version in coordination. Verify against the vendor advisory that your specific version and configuration are addressed by the patch.

Detection guidance

Monitor NGINX worker process crashes and restarts, particularly those coinciding with HTTP/2 or gRPC traffic. Enable NGINX error logging and look for segmentation faults (signal 11) or heap corruption messages. Intrusion detection systems should flag HTTP/2 HEADERS frames with unusually large payloads or multiple header blocks exceeding expected sizes. Network-based detection can identify requests with header fields approaching or exceeding the large_client_header_buffers limit. Correlate crash events with client IP addresses and request patterns to identify potential attack sources. Log queries on configurations: audit large_client_header_buffers settings, verify ignore_invalid_headers state, and document which upstream services use proxy_http_version 2 or grpc_pass.

Why prioritize this

This vulnerability merits high priority due to its combination of network exploitability, potential for remote code execution, and widespread use of NGINX in critical infrastructure roles. The requirement for specific configuration limits the blast radius but does not eliminate risk—many production NGINX deployments use large_client_header_buffers >2MB to accommodate legitimate large headers, and proxy_http_version 2 is increasingly standard. The CVSS score of 8.1 (HIGH) reflects the severity. Prioritize patching systems in perimeter-facing, internet-accessible roles first, then move to internal proxies. Organizations with ASLR disabled should treat this as critical.

Risk score, explained

The CVSS v3.1 score of 8.1 (HIGH) reflects a network-accessible vulnerability (AV:N) with high attack complexity (AC:H) due to configuration prerequisites, no privilege requirement (PR:N), no user interaction (UI:N), and impacts to confidentiality, integrity, and availability (C:H/I:H/A:H). The AC:H component acknowledges that the specific configuration conditions must align; however, these conditions are not rare in production. The HIGH impact metrics reflect both denial-of-service via process crash and the potential for code execution when ASLR is weak. This score appropriately positions the vulnerability as requiring urgent but measured response.

Frequently asked questions