CVE-2026-42055 – Heap Buffer Overflow leading to DoS / RCE – NGINX Plus and Open Source (1.13.10–…

Summary

CVE-2026-42055 is a heap-based buffer overflow (CWE-122) in NGINX Plus and NGINX Open Source, residing in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. Disclosed by F5 on June 17, 2026, the vulnerability allows a remote, unauthenticated attacker to overflow heap memory in an NGINX worker process under a specific — though production-plausible — combination of configuration directives. The result is a guaranteed worker process crash (denial of service) in all affected configurations, escalating to full remote code execution (RCE) on systems where Address Space Layout Randomization (ASLR) is disabled or can be bypassed. The CVSS v3.1 base score is 8.1 (High).

Technical details

• Root cause: A heap-based buffer overflow (CWE-122) in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules, triggered during upstream HTTP/2 or gRPC request creation when client header data is written into an oversized buffer.
• Trigger conditions: All three of the following configuration conditions must be present simultaneously:
  1. proxy_http_version 2 or grpc_pass is used to proxy traffic to an HTTP/2 or gRPC upstream.
  2. The ignore_invalid_headers directive is set to off (non-default).
  3. The large_client_header_buffers directive is configured with a size greater than 2 megabytes (non-default).
• Attack vector: A remote, unauthenticated attacker sends a specially crafted request carrying large headers at the moment an upstream connection is being established. No credentials, account, or user interaction are required.
• Impact: In all affected configurations, the overflow corrupts heap memory in the NGINX worker process, causing a segmentation fault and worker restart (denial of service). On systems with ASLR disabled, or where an attacker can bypass ASLR, the condition is exploitable for arbitrary remote code execution with the privileges of the NGINX worker.
• Discovered by: Mufeed VH of Winfunc Research.

Affected software

• NGINX Open Source (mainline branch): versions 1.13.10 through 1.31.1
• NGINX Open Source (stable branch): versions prior to 1.30.3
• NGINX Plus: R36 P0 through R36 P5
• NGINX Plus LTS: prior to PLS.37.0.2.1

Severity

CVSS v3.1 base score: 8.1 (High)
Vector string: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Mitigation and recommended actions

• Immediate — apply vendor patches:
  • NGINX Open Source (mainline): upgrade to 1.31.2 or later.
  • NGINX Open Source (stable): upgrade to 1.30.3 or later.
  • NGINX Plus: upgrade to R36 P6 or later.
  • NGINX Plus LTS: upgrade to PLS.37.0.2.1 or later.
• Configuration workaround (where immediate patching is not feasible): Remove the triggering condition by applying one of the following changes:
  • Restore the default behavior by setting ignore_invalid_headers on;, or
  • Reduce the large_client_header_buffers size to 2 megabytes or less on any virtual server proxying HTTP/2 or gRPC traffic.
• Audit all NGINX deployments acting as reverse proxies or API gateways for gRPC traffic, as these are most likely to carry the vulnerable configuration combination.

IONIX Status

The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

References

• CVE-2026-42055 at NIST
• F5 Security Advisory K000161584
• NGINX Security Advisories