Threat Intelligence / CVE / CVE-2026-42055

CVE-2026-42055

CVSS 8.1 (HIGH) · EPSS 1.8% · Priority 9.1/10 · Published 2026-06-17

As of 2026-06-18, CVE-2026-42055 is a CVSS 8.1 (HIGH-severity) vulnerability. Public exploit code available. EPSS exploitation probability 1.8%. Threadlinqs Intelligence tracks 1 threat exploiting it.

Last updated: 2026-06-18

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability exists when the proxy_http_version to 2 or grpc_pass directives are used to proxy HTTP/2 traffic, the ignore_invalid_headers directive is set to off, and the large_client_header_buffers directive size is larger than 2 megabytes. A remote, unauthenticated attacker, along with conditions beyond their control, could send large headers while creating an upstream request. This may cause a heap-based buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS v3 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-122

Exploitation status

public exploit code available

HORKimhab/CVE-2026-42055 (github)

Threats tracking this CVE

F5 Out-of-Band Patches for Critical NGINX HTTP/3 Use-After-Free and Proxy/gRPC Heap Overflow (CVE-2026-42530, CVE-2026-42055) plus NGINX Gateway Fabric Config Injection (CVE-2026-11311, CVE-2026-50107) — CRITICAL

References

https://my.f5.com/manage/s/article/K000161584

Full detection coverage & IOCs for threats exploiting CVE-2026-42055 are available via the Threadlinqs MCP server (Purple tier). View plans →

← all vulnerabilities · Markdown version · Threadlinqs Intelligence

Enriched from CVE.org, NVD (this product uses the NVD API but is not endorsed or certified by the NVD), FIRST EPSS, CISA KEV, and GitHub Security Advisories.