{"id":"CVE-2026-42926","aliases":["ALPINE-CVE-2026-42926","BELL-CVE-2026-42926","BIT-nginx-2026-42926","BIT-nginx-gateway-2026-42926","DEBIAN-CVE-2026-42926","EUVD-2026-30006","GHSA-v43f-895r-chhh","MGASA-2026-0156","RHSA-2026:20351","UBUNTU-CVE-2026-42926","openSUSE-SU-2026:10796-1"],"status":"published","title":"NGINX ngx_http_proxy_v2_module vulnerability","description":"When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also uses proxy_set_body, an attacker may be able to inject frame headers and payload bytes to the upstream peer.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","severity":{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00346,"percentile":0.28413,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-172"],"published":"2026-05-13T14:12:45Z","modified":"2026-10-28T02:31:10Z","exploits":[{"source":"pocgithub","id":"ikarolaborda/CVE2026-42926","title":"ikarolaborda/CVE2026-42926","date":"2026-06-06","url":"https://github.com/ikarolaborda/CVE2026-42926"}],"fixes":[{"ecosystem":"Bitnami","package":"nginx","fixed_in":["1.30.1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"nginx-gateway","fixed_in":["1.30.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nginx","fixed_in":["1.30.0-4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"nginx","ranges":[{"type":"SEMVER","events":[{"introduced":"1.29.4"},{"fixed":"1.30.1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"nginx-gateway","ranges":[{"type":"SEMVER","events":[{"introduced":"1.29.4"},{"fixed":"1.30.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.0-4"}]}],"versions":["1.26.3-3","1.28.0-1","1.28.0-2","1.28.0-3","1.28.0-4","1.28.0-5","1.28.0-6","1.28.1-1","1.28.1-2","1.28.1-3","1.28.2-1","1.28.2-2","1.28.2-3","1.28.2-4","1.28.3-1","1.28.3-2","1.30.0-1","1.30.0-2","1.30.0-3"]},{"source":"osv","ecosystem":"Mageia:9","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.1-1.mga9"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.2-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-all-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.2-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.2-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.2-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.2-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-http-geoip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.2-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-http-image-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.2-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-http-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.2-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-http-xslt-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.2-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.2-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-stream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.2-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-stream-geoip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.2-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31.0-1.1"}]}],"bundled":6}],"products":[{"vendor":"f5","product":"nginx open source"},{"vendor":"f5","product":"nginx_gateway_fabric"},{"vendor":"f5","product":"nginx_ingress_controller"},{"vendor":"f5","product":"nginx_instance_manager"},{"vendor":"f5","product":"nginx_open_source"}],"references":[{"url":"https://my.f5.com/manage/s/article/K000161131","tags":["vendor-advisory","patch","Mitigation","Vendor Advisory","advisory","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42926","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-v43f-895r-chhh"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-42926","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-42926","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-42926","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0156.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35529","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/05/13/7","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20351","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-40460","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42926","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9256","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42530","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_20351.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480746","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9256","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9256","tags":["advisory"]},{"url":"https://my.f5.com/manage/s/article/K000161377","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477113","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-40460","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40460","tags":["advisory"]},{"url":"https://my.f5.com/manage/s/article/K000161068","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489872","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42530","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42530","tags":["advisory"]},{"url":"https://my.f5.com/manage/s/article/K000161616","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477068","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42926","tags":["advisory","report"]},{"url":"https://ubuntu.com/security/CVE-2026-42926","tags":["report"]},{"url":"https://nginx.org/en/security_advisories.html","tags":["report"]},{"url":"https://github.com/nginx/nginx/commit/ce3362cfd5c3e1434a6151cfa585b89114389da7","tags":["report"]},{"url":"https://github.com/nginx/nginx/commit/a0e742944db64d8a547cc2e7a0ba4c2e85cd4b98","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40460","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40701","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42926","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42946","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-42926","title":"NGINX ngx_http_proxy_v2_module vulnerability","description":"When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also uses proxy_set_body, an attacker may be able to inject frame headers and payload bytes to the upstream peer.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-05-13T14:12:45.695Z","modified":"2026-05-13T16:16:54.456Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-172"],"updated_at":"2026-11-02T13:40:12.486331Z"}],"euvd":[{"id":"EUVD-2026-30006","description":"When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also uses proxy_set_body, an attacker may be able to inject frame headers and payload bytes to the upstream peer.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-05-13T14:12:45Z","modified":"2026-05-13T16:16:54Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:04:33.260537Z"}],"ghsa":[{"id":"GHSA-v43f-895r-chhh","title":"When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2,...","description":"When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also uses proxy_set_body, an attacker may be able to inject frame headers and payload bytes to the upstream peer.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-05-13T18:30:56Z","modified":"2026-05-13T18:31:06Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-172"],"updated_at":"2026-11-02T15:08:07.741271Z"}],"nvd":[{"id":"CVE-2026-42926","description":"When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also uses proxy_set_body, an attacker may be able to inject frame headers and payload bytes to the upstream peer.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-05-13T16:16:49.64Z","modified":"2026-10-26T14:10:00.13Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-172"],"updated_at":"2026-11-02T14:12:19.020465Z"}],"osv":[{"id":"ALPINE-CVE-2026-42926","description":"When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also uses proxy_set_body, an attacker may be able to inject frame headers and payload bytes to the upstream peer.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"withdrawn","published":"2026-05-13T16:16:49.64Z","modified":"2026-07-14T08:03:34.099923704Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:27:50.764331Z"},{"id":"BELL-CVE-2026-42926","title":"CVE-2026-42926 does not affect BellSoft software","status":"withdrawn","published":"2026-05-15T14:24:10.558267Z","modified":"2026-05-16T07:17:51.28883Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:23.844435Z"},{"id":"CVE-2026-42926","description":"When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also uses proxy_set_body, an attacker may be able to inject frame headers and payload bytes to the upstream peer.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-05-13T16:16:49.64Z","modified":"2026-10-28T02:31:10.297487894Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:04.117819Z"},{"id":"DEBIAN-CVE-2026-42926","description":"When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also uses proxy_set_body, an attacker may be able to inject frame headers and payload bytes to the upstream peer.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-05-13T16:16:49.64Z","modified":"2026-10-27T09:47:40.249742435Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:55.251751Z"},{"id":"RHSA-2026:20351","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-05-26T10:07:21Z","modified":"2026-10-17T10:10:38Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"UBUNTU-CVE-2026-42926","description":"When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also uses proxy_set_body, an attacker may be able to inject frame headers and payload bytes to the upstream peer.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"withdrawn","published":"2026-05-13T16:16:00Z","modified":"2026-05-30T16:00:15.947193275Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium"},{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:56:18.393417Z"},{"id":"BIT-nginx-2026-42926","title":"NGINX ngx_http_proxy_v2_module vulnerability","description":"When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also uses proxy_set_body, an attacker may be able to inject frame headers and payload bytes to the upstream peer.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-05-15T08:50:04.51Z","modified":"2026-09-08T08:48:16.758292403Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"BIT-nginx-gateway-2026-42926","title":"NGINX ngx_http_proxy_v2_module vulnerability","description":"When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also uses proxy_set_body, an attacker may be able to inject frame headers and payload bytes to the upstream peer.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-05-15T08:50:06.85Z","modified":"2026-09-08T08:48:16.760275901Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"MGASA-2026-0156","title":"Updated nginx packages fix security vulnerabilities","description":"NGINX ngx_quic_module vulnerability. (CVE-2026-40460)\nNGINX ngx_http_ssl_module vulnerability. (CVE-2026-40701)\nNGINX ngx_http_proxy_v2_module vulnerability. (CVE-2026-42926)\nNGINX ngx_http_charset_module vulnerability. (CVE-2026-42934)\nNGINX ngx_http_rewrite_module vulnerability. (CVE-2026-42945)\nNGINX ngx_http_scgi_module and ngx_http_uwsgi_module vulnerability.\n(CVE-2026-42946)\n","status":"published","published":"2026-05-26T01:55:28Z","modified":"2026-05-26T02:00:04.269313969Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:10796-1","title":"nginx-1.31.0-1.1 on GA media","description":"These are all security issues fixed in the nginx-1.31.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-16T00:00:00Z","modified":"2026-05-17T14:18:07.625976Z","updated_at":"2026-11-02T16:58:38.415593Z"}]}}