Is CVE-2026-42926 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42926 being exploited in the wild.

How severe is CVE-2026-42926?

Medium severity, with a CVSS score of 5.8, published 13 May 2026.

Which products and versions are affected?

F5 NGINX Instance Manager 2.16.0 to 2.22.0; F5 Nginx Gateway Fabric 1.3.0 to 1.6.2, 2.0.0 to 2.6.0; F5 Nginx Ingress Controller 3.5.0 to 3.7.2, 4.0.0 to 4.0.1, 5.0.0 to 5.4.2.

Is there a fix for CVE-2026-42926?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-42926 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-42926?

Check whether you run F5 NGINX Instance Manager, F5 Nginx Gateway Fabric, F5 Nginx Ingress Controller or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42926: F5 NGINX Open Source header injection in HTTP/2 proxying

CVE-2026-42926 · Severity: medium · CVSS 5.8 · Published 2026-05-13

NGINX Open Source and related NGINX products are vulnerable to a security flaw when configured to handle HTTP/2 traffic in a specific way. An attacker can exploit this to inject unauthorized data or headers into the communication between NGINX and the backend servers it manages. This could lead to data integrity issues or the bypass of certain security controls within the internal network.

Technologies: F5 NGINX Instance Manager, F5 Nginx Gateway Fabric, F5 Nginx Ingress Controller, NGINX Open Source. Vendors: F5, NGINX.

Quick answers

Is CVE-2026-42926 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42926 being exploited in the wild.
How severe is CVE-2026-42926?: Medium severity, with a CVSS score of 5.8, published 13 May 2026.
Which products and versions are affected?: F5 NGINX Instance Manager 2.16.0 to 2.22.0; F5 Nginx Gateway Fabric 1.3.0 to 1.6.2, 2.0.0 to 2.6.0; F5 Nginx Ingress Controller 3.5.0 to 3.7.2, 4.0.0 to 4.0.1, 5.0.0 to 5.4.2.
Is there a fix for CVE-2026-42926?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-42926 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-42926?: Check whether you run F5 NGINX Instance Manager, F5 Nginx Gateway Fabric, F5 Nginx Ingress Controller or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is classified as an encoding error (CWE-172) within the ngx_http_proxy_v2_module. It occurs when NGINX is configured to proxy HTTP/2 traffic (proxy_http_version 2) and simultaneously uses the 'proxy_set_body' directive. An unauthenticated remote attacker can exploit this configuration to inject arbitrary frame headers and payload bytes into the stream sent to the upstream peer. This could potentially be used for request smuggling or bypassing security filters. The issue is addressed in NGINX Open Source version 1.31.0 and various patched versions of F5's NGINX-based products.

Affected products

F5 NGINX Open Source 1.29.4 to 1.30.0
F5 NGINX Gateway Fabric 1.3.0 to 1.6.2, 2.0.0 to 2.6.0
F5 NGINX Ingress Controller 3.5.0 to 3.7.2, 4.0.0 to 4.0.1, 5.0.0 to 5.4.2
F5 NGINX Instance Manager 2.16.0 to 2.22.0

Timeline

2026-05-13: disclosed
2026-05-13: advisory

References

https://my.f5.com/manage/s/article/K000161131

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.