CVE-2026-42055 is a heap-based buffer overflow vulnerability in F5 NGINX Open Source's ngx_http_proxy_v2_module and ngx_http_grpc_module. It occurs when proxy_http_version is set to 2 or grpc_pass directives are used to proxy HTTP/2 traffic, the ignore_invalid_headers directive is off, and large_client_header_buffers is configured with a size larger than 2 megabytes. Under these conditions, a remote unauthenticated attacker can send large headers that cause a heap overflow in the NGINX worker process, leading to a restart or potential code execution on systems with ASLR disabled or bypassed. The vulnerability affects versions 1.13.10 and 1.30.2. The vendor has not yet provided an official fix or patch.

The vulnerability allows a remote unauthenticated attacker to cause a denial of service by crashing the NGINX worker process through a heap-based buffer overflow. Additionally, on systems where ASLR is disabled or can be bypassed, the attacker may achieve remote code execution. This impacts confidentiality, integrity, and availability of affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid configurations that set proxy_http_version to 2 or use grpc_pass with ignore_invalid_headers off and large_client_header_buffers larger than 2 megabytes. Monitor vendor communications for updates and apply patches once released.