Skip to content
Sign in
CVE-2026-420559.2CriticalCWE-122

NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability

F5 · NGINX Open Source

Not in CISA KEVVendor fix available
6.5%probability of exploitation in the next 30 days
93rd percentile
050100

Higher than 93% of scored CVEs

9.2CriticalCVSS 3.1
LowCrit.

DescriptionNVD

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability exists when the proxy_http_version to 2 or grpc_pass directives are used to proxy HTTP/2 traffic, the ignore_invalid_headers directive is set to off, and the large_client_header_buffers directive size is larger than 2 megabytes. A remote, unauthenticated attacker, along with conditions beyond their control, could send large headers while creating an upstream request. This may cause a heap-based buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Coverage3 articles · 3 outlets

One row per outlet, in order of first report. First in our coverage: Security Affairs, 18 Jun.

Full timeline
Quiet for 19 weekslast report 19 Jun3 articles3 outlets
18 Jun · Security Affairs first28 Aug21 SepNow
  • Thu 18 Jun, 15:11 UTC. Security Affairs, first report. F5 Patches Critical NGINX Vulnerabilities Enabling Unauthenticated Code Execution.
  • Fri 19 Jun, 03:31 UTC. SecurityOnline, its first report on the story. F5 Patches Two Critical NGINX Flaws in HTTP/3 and HTTP/2 Modules (CVE-2026-42530, CVE-2026-42055).
  • Fri 19 Jun, 14:02 UTC. SOCRadar, its first report on the story. F5 releases patches for critical NGINX HTTP/3 and HTTP/2 flaws.
All coveragerunning total3Security Af…1SecurityOnl…1SOCRadar119 Jun4 Aug19 SepNow
  • First report
  • Article
  • Running total
Show as table
3 articles about CVE-2026-42055 from 3 outlets
Published (UTC)OutletHeadline
18 Jun 15:11Security AffairsF5 Patches Critical NGINX Vulnerabilities Enabling Unauthenticated Code Execution
19 Jun 03:31SecurityOnlineF5 Patches Two Critical NGINX Flaws in HTTP/3 and HTTP/2 Modules (CVE-2026-42530, CVE-2026-42055)
19 Jun 14:02SOCRadarF5 releases patches for critical NGINX HTTP/3 and HTTP/2 flaws
  1. F5 releases patches for critical NGINX HTTP/3 and HTTP/2 flaws
    SOCRadar · mentions it in passing
  2. F5 Patches Two Critical NGINX Flaws in HTTP/3 and HTTP/2 Modules (CVE-2026-42530, CVE-2026-42055)
    SecurityOnline · mentions it in passing
  3. F5 Patches Critical NGINX Vulnerabilities Enabling Unauthenticated Code Execution
    Security Affairs · first in our coverage · mentions it in passing

New articles also arrive in the RSS feed.

References

CyberSIXTSignal over noise
Updated AboutDevelopersSign in