CVE-2026-42055 is a heap-based buffer overflow in the NGINX modules used for upstream HTTP/2 and gRPC proxying. It is conditional, not a blanket vulnerability in every NGINX deployment: the affected proxy behavior, disabled invalid-header filtering, and oversized non-default client-header buffers must all be present [S1][S4].
Affected configurations and versions
The vendor record covers NGINX Open Source and NGINX Plus only when all documented configuration prerequisites coincide [S1][S4]. For NGINX Open Source, the affected published releases are 1.13.10 through 1.30.2, plus 1.31.0 and 1.31.1; nginx.org identifies 1.30.3+ stable and 1.31.2+ mainline as not vulnerable [S2][S3]. F5's CNA record also lists NGINX Plus R37 37.0 releases before 37.0.2.1 and R36 releases before R36 P6 as affected; versions past End of Technical Support were not evaluated [S1][S4].
Impact and severity
A remote unauthenticated attacker could trigger a heap overflow in an NGINX worker under the required configuration conditions, causing the worker to restart and potentially disrupting service. Code execution is additionally conditional on Address Space Layout Randomization (ASLR) being disabled or bypassed [S1][S4].
F5 assigns CVSS v3.1 8.1 (High), with High attack complexity, while nginx.org labels the advisory Medium [S1][S2][S4]. These are separate published rating systems, so both are shown here with attribution.
How FixVibe covers it
FixVibe's GitHub repository scans flag Dockerfile-based deployments that pin an exact affected release of the official NGINX Open Source container image together with the unusual upstream proxy configuration described by the vendor [S1][S4], reported as a likely issue with the image, configuration location and fixed-release guidance. Coverage focuses on the official NGINX Open Source image and repository-supplied configuration.
Remediation
Upgrade to a fixed, supported release. For NGINX Open Source, use 1.30.3 or 1.31.2, or a newer supported release; NGINX Plus users should apply the corresponding F5-supported patch level [S1][S2][S3][S4]. Pin the corrected image release, rebuild it, and redeploy every affected component.
Review the complete effective configuration as well. Keep invalid-header validation enabled, avoid oversized client-header buffer settings unless they are operationally required, and stop using upstream HTTP/2 or gRPC proxying where it is unnecessary. Verify the running version with nginx -v, review the effective configuration with nginx -T, run nginx -t, and exercise only benign HTTP/2 and gRPC smoke tests before rerunning the FixVibe repository scan. Do not validate the fix with crash-inducing or memory-corruption traffic.