CVE-2026-42055 is a heap-based buffer overflow vulnerability in NGINX Open Source and NGINX Plus affecting the ngx_http_proxy_v2_module and ngx_http_grpc_module. It is triggered when proxy_http_version is set to 2 or grpc_pass directives are used to proxy HTTP/2 traffic, ignore_invalid_headers is off, and large_client_header_buffers is configured larger than 2 MB. Under these conditions, a remote unauthenticated attacker can send crafted large headers that cause a heap overflow in the NGINX worker process, potentially leading to a denial of service via process restart or arbitrary code execution on systems with ASLR disabled or bypassed. Red Hat has issued security advisories and patches for affected NGINX packages in Red Hat Enterprise Linux 10 to fix this vulnerability. The CVSS v3.1 base score is 8.1, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring no privileges or user interaction but high attack complexity.

The vulnerability allows a remote unauthenticated attacker to cause a heap-based buffer overflow in the NGINX worker process, which can lead to denial of service through process restart. Additionally, on systems where Address Space Layout Randomization (ASLR) is disabled or can be bypassed, the attacker may achieve arbitrary code execution. This impacts the confidentiality, integrity, and availability of the affected system. No known exploits in the wild have been reported at the time of this advisory.

Red Hat has released security updates for NGINX packages on Red Hat Enterprise Linux 10 that address this vulnerability. Applying these official patches will remediate the issue. Users should update to the fixed versions provided by Red Hat as detailed in their advisories (e.g., nginx-1.26.3-6.el10_2.5 and later). Since this is not a cloud service, remediation depends on applying vendor patches. Patch status is confirmed by Red Hat advisories linked in the references. No alternative mitigations or workarounds are indicated in the vendor advisory.