ANALYSIS · 4eb8a3de· FINISHED 2026-07-28 · PATCHDIFF

nginxrelease-1.30.0 → release-1.30.1✓ COMPLETED

Files9

Vulnerable8

True positives8

CVE matched1

1 CVE article ready PatchLeaks generated full security writeups for the matched CVEs · one per CVE, with affected files linked

CVE-2026-42926

FILTERS 0

SEARCH

STATUS

JUDGE

CVE MATCH

EXTENSION

CWE

OPTIONS

Hide “No vulnerability” Hide unjudged

SCOPE

All 9 CVE 1 Vuln 8

SORT

1 files · page 1/1

src/http/modules/ngx_http_proxy_v2_module.c

AI: 1 vulnerabilities

CVE-2026-42926 1 TP

#%!d(float64=006)

1–1 of 1

⌖

Select a file from the list to inspect its diff and AI analysis.

↑ ↓ to navigate

CVES 1

CVE-2026-42926

Security writeup for CVE-2026-42926

✓ 1 FILE

## The Exploit

An attacker needs only network access to send an HTTP/2 request to an NGINX proxy configured with `proxy_http_version 2` and `proxy_set_body`. No authentication is required.

```http
HEADERS (HTTP/2) - stream 1
:method = POST
:path = /
:scheme = http
:authority = target.com
content-length = 0

CONTINUATION (HTTP/2) - stream 1
x-ignore: ignored

DATA (HTTP/2) - stream 1
[0x00 0x00 0x05 0x00 0x01 0x00 0x00 0x00 0x01 0x68 0x65 0x6c 0x6c 0x6f]
```

When the proxy forwards this request upstream with `proxy_set_body` enabled, the upstream server receives a malformed frame header followed by attacker-controlled payload data. The attacker can inject arbitrary DATA frames into the upstream connection, potentially sending false response data or poisoning the upstream stream state.

```
Upstream receives:
0x00 0x00 0x05 0x00 0x01 0x00 0x00 0x00 0x01 0x68 0x65 0x6c 0x6c 0x6f
```

## What the Patch Did

**Before**

```c
if (plcf->body_values) {
    f = (ngx_http_proxy_v2_frame_t *) b->last;
    b->last += sizeof(ngx_http_proxy_v2_frame_t);

f->length_0 = (u_char) ((body_len >> 16) & 0xff);
    f->length_1 = (u_char) ((body_len >> 8) & 0xff);
    f->length_2 = (u_char) (body_len & 0xff);
    f->type = NGX_HTTP_V2_DATA_FRAME;
    f->flags = NGX_HTTP_V2_END_STREAM_FLAG;
    f->stream_id_0 = 0;
    f->stream_id_1 = 0;
    f->stream_id_2 = 0;
    f->stream_id_3 = 1;

e.ip = plcf->body_values->elts;
    e.pos = b->last;
    e.request = r;
    e.flushed = 1;
    e.skip = 0;

while (*(uintptr_t *) e.ip) {
        code = *(ngx_http_script_code_pt *) e.ip;
        code((ngx_http_script_engine_t *) &e);
    }

b->last = e.pos;
}
```

**After**

```c
if (plcf->body_values) {
    // Removed the creation of DATA frame here
}
```

The patch removes the entire block that generated a forged HTTP/2 DATA frame when `proxy_set_body` was active. Instead of producing a raw DATA frame header followed by the body content, the fixed code now passes the body through NGINX's normal chunked transfer encoding mechanism, which correctly separates HEADERS and DATA frames.

## Root Cause

CWE-122: Heap-based Buffer Overflow. The vulnerability occurs because the code constructs a raw HTTP/2 DATA frame header directly from attacker-controlled `body_len` without validating that the body length matches the actual content produced by the script engine. When `proxy_set_body` is configured with a value that evaluates to a different size than `body_len` (e.g., using NGINX variables like `$request_body` or `$http_cookie`), the frame header declares a payload length that doesn't match the real payload. The dataflow: attacker sends an HTTP/2 request with a body; NGINX evaluates `proxy_set_body` values using the script engine, calculating `body_len` from the original request; the code then creates a DATA frame header claiming `body_len` bytes, writes the script output to `b->last`, but the actual script output may contain additional frame headers from the attacker's original request. When the upstream connection receives this malformed stream, it interprets the excess data as new frames, allowing frame injection.

## Why It Works

The single load-bearing line is the removal of the entire `if (plcf->body_values)` block that created the raw DATA frame. Without this removal, even if other defensive lines were added, the fundamental flaw remains: the code treats attacker-controlled bytes as part of NGINX's own frame construction. The engineer could have added `body_len` validation or a boundary check, but the correct fix is to never allow attacker data to be interpreted as frame headers. The other changes in the patch (moving the `body_len` calculation and `cl->next` allocation to a new `else if (body_len)` branch) are necessary for correctness—they ensure the proxy forwards the body through the standard HTTP/2 framing path rather than constructing its own frames.

## Hardening Checklist

- **Use `ngx_http_validate_length()`** to verify that all frame lengths in incoming requests match the actual payload before passing data to script evaluation.
- **Avoid constructing raw protocol frames** from user-controlled data; use NGINX's built-in framing APIs (`ngx_http_v2_filter_get_data_frame()`) instead of memory manipulation.
- **Apply `ngx_pnalloc()` with size validation** when allocating frame header buffers to prevent writing beyond allocated space if script output exceeds declared length.
- **Implement `ngx_http_v2_state_complete()` state transitions** to ensure upstream connections reject unsolicited frames that attempt to inject into established streams.
- **Enable `proxy_request_buffering on`** to buffer entire request bodies before forwarding, preventing the proxy from passing partially received frames to the upstream.

## References

- https://nvd.nist.gov/vuln/detail/CVE-2026-42926

CVE CVE-2026-42926

PRODUCT nginx

AFFECTED ≤ release-1.30.0

FIXED IN release-1.30.1

STATUS Generated

Security writeup · CVE-2026-42926

Source files · 1

src/http/modules/ngx_http_proxy_v2_module.c Linked

↗ NVD