Is CVE-2026-42055 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42055 being exploited in the wild.

How severe is CVE-2026-42055?

High severity, with a CVSS score of 8.1, published 17 June 2026.

Which products and versions are affected?

F5 Nginx Plus R36 to R36 P5, 37.0 to 37.0.2.0.

Is there a fix for CVE-2026-42055?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-42055 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-42055?

Check whether you run F5 Nginx Plus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42055: NGINX heap buffer overflow in HTTP/2 and gRPC proxy modules

CVE-2026-42055 · Severity: high · CVSS 8.1 · Published 2026-06-17

NGINX Plus and NGINX Open Source, widely used web server and proxy software, are vulnerable to a flaw that could allow an attacker to crash the service or potentially take control of the system. The issue occurs when NGINX is configured to proxy HTTP/2 or gRPC traffic with specific large header settings. Successful exploitation could lead to service outages or unauthorized access to sensitive data and internal operations.

Technologies: F5 Nginx Plus. Vendors: F5.

Quick answers

Is CVE-2026-42055 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42055 being exploited in the wild.
How severe is CVE-2026-42055?: High severity, with a CVSS score of 8.1, published 17 June 2026.
Which products and versions are affected?: F5 Nginx Plus R36 to R36 P5, 37.0 to 37.0.2.0.
Is there a fix for CVE-2026-42055?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-42055 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-42055?: Check whether you run F5 Nginx Plus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow vulnerability exists in the ngx_http_proxy_v2_module and ngx_http_grpc_module of NGINX. The flaw is triggered when 'proxy_http_version' is set to 2 or 'grpc_pass' is used, 'ignore_invalid_headers' is disabled, and 'large_client_header_buffers' is configured to a size exceeding 2 megabytes. A remote, unauthenticated attacker can exploit this by sending specially crafted large headers during an upstream request. This leads to a worker process restart (DoS) or potential remote code execution on systems where ASLR is disabled or bypassed. Patches are available in NGINX Open Source 1.31.2, 1.30.3 and NGINX Plus R36 P6, 37.0.2.1.

Affected products

F5 NGINX Open Source 1.13.10 to 1.31.1, 1.30.2
F5 NGINX Plus R36 to R36 P5, 37.0 to 37.0.2.0

Timeline

2026-06-17: disclosed
2026-06-17: advisory

References

https://my.f5.com/manage/s/article/K000161584

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.