Skip to content
CVE PROGRAM SOURCE RECORD6.3 Medium

CVE-2026-42926

NGINX ngx_http_proxy_v2_module vulnerability

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
f5

Description

When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also uses proxy_set_body, an attacker may be able to inject frame headers and payload bytes to the upstream peer.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

F5 NGINX Open Source

Default version status: unaffected

  • 1.31.0 to < *unaffected
  • 1.29.4 to < 1.30.1affected

References