CVE-2026-42055 Details

A heap-based buffer overflow vulnerability has been identified in NGINX Plus (versions 37.0.0 to 37.0.1) and NGINX Open Source (versions 1.30.0 to 1.30.2 and 1.31.1) within the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability arises when proxying HTTP/2 traffic with the proxy_http_version set to 2 or using grpc_pass, while the ignore_invalid_headers directive is off and the large_client_header_buffers directive allows headers larger than 2 megabytes. Under these conditions, a remote, unauthenticated attacker could send large headers in an upstream request, potentially causing a heap-based buffer overflow in the NGINX worker process, leading to a crash. Furthermore, on systems with Address Space Layout Randomization (ASLR) disabled or where ASLR can be bypassed, this vulnerability could be exploited to execute arbitrary code.

To address this vulnerability, users can upgrade to NGINX Plus version 37.0.2.1 or NGINX Open Source versions 1.31.2 or 1.30.3. For NGINX Instance Manager, versions 2.22.0 and later should be used. If using NGINX App Protect WAF, upgrade to version 5.9.0 or later. For NGINX Gateway Fabric, version 2.6.4 or later is recommended. Users can also mitigate the vulnerability by removing the ignore_invalid_headers off directive from the configuration or by reducing the large_client_header_buffers directive size to below 2 megabytes.