ANALYSIS · ff21b2af· FINISHED 2026-07-28 · PATCHDIFF

nginxrelease-1.30.2 → release-1.30.3✓ COMPLETED

Files4

Vulnerable3

True positives2

CVE matched2

1 CVE article ready PatchLeaks generated full security writeups for the matched CVEs · one per CVE, with affected files linked

CVE-2026-42055

FILTERS 0

SEARCH

STATUS

JUDGE

CVE MATCH

EXTENSION

CWE

OPTIONS

Hide “No vulnerability” Hide unjudged

SCOPE

All 4 CVE 2 Vuln 3

SORT

2 files · page 1/1

src/http/modules/ngx_http_grpc_module.c

AI: 5 vulnerabilities

CVE-2026-42055 5 TP

#%!d(float64=003)

src/http/modules/ngx_http_proxy_v2_module.c

AI: 1 vulnerabilities

CVE-2026-42055 1 FP

#%!d(float64=004)

1–2 of 2

⌖

Select a file from the list to inspect its diff and AI analysis.

↑ ↓ to navigate

CVES 1

CVE-2026-42055

Security writeup for CVE-2026-42055

✓ 2 FILES

## The Exploit

An unauthenticated remote attacker with the ability to send HTTP/2 requests to an NGINX server configured with `proxy_http_version 2` or `grpc_pass`, `ignore_invalid_headers off`, and `large_client_header_buffers` > 2MB can trigger a heap buffer overflow by sending an oversized header name or value.

```bash
# Send a crafted HTTP/2 request with an oversized header value (>16384 bytes)
# Replace TARGET_HOST with the actual NGINX server
curl -k --http2 -H "X-CustomHeader: $(python3 -c 'print("A"*20000)')" \
  "https://TARGET_HOST/some-path"
```

When the request is processed, the NGINX worker process will crash and restart, observable in the error log as a SIGSEGV or heap corruption message. In environments without ASLR, or if ASLR is bypassed, this crash can be escalated to remote code execution.

## What the Patch Did

**Before (vulnerable code in `ngx_http_grpc_module.c`):**
```c
// No check for NGX_HTTP_V2_MAX_FIELD on header name or value
len += 1 + NGX_HTTP_V2_INT_OCTETS + key_len
         + NGX_HTTP_V2_INT_OCTETS + val_len;
```

**After (fixed code):**
```c
if (key_len > NGX_HTTP_V2_MAX_FIELD) {
    ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
                  "too long http2 header name");
    return NGX_ERROR;
}
if (val_len > NGX_HTTP_V2_MAX_FIELD) {
    ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
                  "too long http2 header value");
    return NGX_ERROR;
}
len += 1 + NGX_HTTP_V2_INT_OCTETS + key_len
         + NGX_HTTP_V2_INT_OCTETS + val_len;
```

The patch adds explicit size validation checks for both header names and values against the `NGX_HTTP_V2_MAX_FIELD` constant (16384 bytes). This is a classic input validation fix — the `ngx_http_v2_module` API already defined the field size limit, but the `ngx_http_grpc_module` was not enforcing it. The patch also adds corresponding checks for method, URI, and host fields.

## Root Cause

**CWE-122: Heap-based Buffer Overflow.** The vulnerability exists because when an HTTP/2 request is proxied upstream via the gRPC module, the code constructs the upstream HTTP/2 HEADERS frame by directly calculating buffer lengths from the input header fields. The upstream buffer is pre-allocated based on initial estimates, but attacker-supplied header names and values can exceed the `NGX_HTTP_V2_MAX_FIELD` limit (16384 bytes) and the internal buffer size. Specifically, the `len` variable accumulates field sizes without validation, then a `ngx_pnalloc()` call allocates a buffer large enough for the attacker-controlled length — but the actual padding and framing overhead can cause the downstream WRITE operation to overflow the heap allocation when `large_client_header_buffers` is set to a size larger than 2MB. The dataflow: HTTP/2 HEADERS frame → `ngx_http_grpc_create_request()` → unchecked `key_len` / `val_len` → heap buffer write without bounds check.

## Why It Works

The single load-bearing line is the `val_len` check: `if (val_len > NGX_HTTP_V2_MAX_FIELD)`. If you removed only this check, an attacker could still send headers with values longer than 16384 bytes and overflow the buffer. The other checks for method, URI, host, and header name length are defense-in-depth — they prevent similar overflows from other field types but are not strictly necessary to block the most common attack vector (oversized header values). The engineer added them because any of these fields could theoretically be the overflow vector if the attacker controls enough of the request structure, and because consistency with the HTTP/2 specification's field size limits reduces the overall attack surface.

## Hardening Checklist

- Implement maximum field length checks using `NGX_HTTP_V2_MAX_FIELD` (or equivalent constant) for all user-controllable fields that are used in buffer size calculations, not just the ones that appear in the first exploit attempt.
- Add a `ngx_conf_check_value()` handler in the configuration parsing for `large_client_header_buffers` to reject values above 2MB when proxy HTTP/2 is enabled, preventing the preconditions for the overflow.
- Use `ngx_pnalloc()` with explicit bounds checking via `ngx_slab_alloc()` or add a post-allocation size verification that compares the actual allocated size against the computed framing overhead.
- Enforce HTTP/2 max frame size limits at the protocol level using `ngx_http_v2_module`'s `SETTINGS_MAX_FRAME_SIZE` before any upstream encoding, rather than relying on later validation in the module-specific code.
- Add unit tests that feed oversize headers (with lengths just above and well above NGX_HTTP_V2_MAX_FIELD) to the request creation path and assert failure, preventing regression.

## References

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-42055

CVE CVE-2026-42055

PRODUCT nginx

AFFECTED ≤ release-1.30.2

FIXED IN release-1.30.3

STATUS Generated

Security writeup · CVE-2026-42055

Source files · 2

src/http/modules/ngx_http_grpc_module.c Linked

src/http/modules/ngx_http_proxy_v2_module.c Linked

↗ NVD