CVE-2026-42055: NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability

Synopsis

Heap-based buffer overflow in NGINX Open Source and NGINX Plus affects the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. The vulnerability is reachable over the network without authentication, but exploitation requires a specific combination of configuration conditions (proxy_http_version 2 or grpc_pass in use, ignore_invalid_headers set to off, and large_client_header_buffers sized above 2 MB) along with circumstances partially outside the attacker's control. Successful exploitation crashes the NGINX worker process, and on systems where ASLR is disabled or bypassable, attackers can achieve remote code execution. Patched-image rebuilds at versions 1.30.3, 1.31.2, 37.0.2.1, and R36 P6 are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the NGINX service over the network to send the crafted large headers that trigger the overflow.

• AuthenticationNot required

  No credentials or account are needed; the attack is available to any unauthenticated remote sender.

• Victim interactionNot required

  No user action is required; the attacker interacts directly with the NGINX service without involving any human victim.

• Attack complexityDetail

  Exploitation is high complexity, requiring a specific NGINX configuration (proxy_http_version 2 or grpc_pass, ignore_invalid_headers off, large_client_header_buffers above 2 MB) plus environmental conditions partially outside the attacker's control, such as ASLR being disabled or bypassable for code execution to succeed.

Blast Radius

• Crashes the NGINX worker process, causing it to restart and dropping in-flight HTTP/2 and gRPC requests served through the affected upstream proxy configuration.
• On systems with ASLR disabled, the attacker gains arbitrary code execution inside the NGINX worker process.
• On systems where the attacker can bypass ASLR, the attacker similarly achieves code execution within the worker process context, with access to memory and file descriptors held by that process.
• Confidentiality and integrity of data handled by the worker process are fully compromised on systems where code execution is achieved.