CVE-2026-42055 is a heap-based buffer overflow in the NGINX modules used for upstream HTTP/2 and gRPC proxying. It is conditional, not a blanket vulnerability in every NGINX deployment: the affected proxy behavior, disabled invalid-header filtering, and oversized non-default client-header buffers must all be present [S1][S4].
Affected configurations and versions
The vendor record covers NGINX Open Source and NGINX Plus only when all documented configuration prerequisites coincide [S1][S4]. For NGINX Open Source, the affected published releases are 1.13.10 through 1.30.2, plus 1.31.0 and 1.31.1; nginx.org identifies 1.30.3+ stable and 1.31.2+ mainline as not vulnerable [S2][S3]. F5's CNA record also lists NGINX Plus R37 37.0 releases before 37.0.2.1 and R36 releases before R36 P6 as affected; versions past End of Technical Support were not evaluated [S1][S4].
Impact and severity
A remote unauthenticated attacker could trigger a heap overflow in an NGINX worker under the required configuration conditions, causing the worker to restart and potentially disrupting service. Code execution is additionally conditional on Address Space Layout Randomization (ASLR) being disabled or bypassed [S1][S4].
F5 assigns CVSS v3.1 8.1 (High), with High attack complexity, while nginx.org labels the advisory Medium [S1][S2][S4]. These are separate published rating systems, so FixVibe presents both with attribution rather than treating either label as universal.
How FixVibe covers it
FixVibe GitHub repository scans report a Likely issue with medium confidence when repository-visible evidence links an exact affected release of the official NGINX Open Source container image to the unusual upstream proxy configuration described by the vendor [S1][S4]. The finding identifies the relevant image/version and configuration locations, provides fixed-release guidance, and distinguishes verified repository evidence from unverified runtime state.
Coverage is intentionally conservative. It currently focuses on Dockerfile-based components that use the official NGINX Open Source image and repository-supplied configuration. It does not claim coverage for NGINX Plus, distribution packages, custom or private images, floating version tags, configuration assembled outside the repository, or the deployed runtime. A finding does not prove that the artifact is deployed, reachable, or exploitable, and no finding is not a guarantee that every runtime is unaffected.
FixVibe does not run NGINX, send hazardous header traffic, crash-test workers, inspect ASLR, or attempt memory corruption or code execution. Confirming those behaviors would cross a safe scanning boundary.
Remediation
Upgrade to a fixed, supported release. For NGINX Open Source, use 1.30.3 or 1.31.2, or a newer supported release; NGINX Plus users should apply the corresponding F5-supported patch level [S1][S2][S3][S4]. Pin the corrected image release, rebuild it, and redeploy every affected component.
Review the complete effective configuration as well. Keep invalid-header validation enabled, avoid oversized client-header buffer settings unless they are operationally required, and stop using upstream HTTP/2 or gRPC proxying where it is unnecessary. Verify the running version with nginx -v, review the effective configuration with nginx -T, run nginx -t, and exercise only benign HTTP/2 and gRPC smoke tests before rerunning the FixVibe repository scan. Do not validate the fix with crash-inducing or memory-corruption traffic.