Executive brief
NGINX Plus and NGINX Open Source, widely used web server and proxy software, are vulnerable to a flaw that could allow an attacker to crash the service or potentially take control of the system. The issue occurs when NGINX is configured to proxy HTTP/2 or gRPC traffic with specific large header settings. Successful exploitation could lead to service outages or unauthorized access to sensitive data and internal operations.
Technical details
A heap-based buffer overflow vulnerability exists in the ngx_http_proxy_v2_module and ngx_http_grpc_module of NGINX. The flaw is triggered when 'proxy_http_version' is set to 2 or 'grpc_pass' is used, 'ignore_invalid_headers' is disabled, and 'large_client_header_buffers' is configured to a size exceeding 2 megabytes. A remote, unauthenticated attacker can exploit this by sending specially crafted large headers during an upstream request. This leads to a worker process restart (DoS) or potential remote code execution on systems where ASLR is disabled or bypassed. Patches are available in NGINX Open Source 1.31.2, 1.30.3 and NGINX Plus R36 P6, 37.0.2.1.
Affected products
- F5 NGINX Open Source 1.13.10 to 1.31.1, 1.30.2
- F5 NGINX Plus R36 to R36 P5, 37.0 to 37.0.2.0
Timeline
- 2026-06-17: disclosed
- 2026-06-17: advisory