Vulnerability · Published May 13, 2026 · Assigned by f5

CVE-2026-42926NGINX ngx_http_proxy_v2_module vulnerability

Medium 5.8

In plain English

A medium-severity security flaw in NGINX Open Source from F5. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.8Medium

Exploit odds (30 days)0.3%top 71.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also uses proxy_set_body, an attacker may be able to inject frame headers and payload bytes to the upstream peer. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Alpine:v3.24	nginx	0	ALPINE-CVE-2026-42926
Debian:14	nginx	1.30.0-4	DEBIAN-CVE-2026-42926
Ubuntu:22.04:LTS	nginx	no fix listed	UBUNTU-CVE-2026-42926
Ubuntu:24.04:LTS	nginx	no fix listed	UBUNTU-CVE-2026-42926
Ubuntu:25.10	nginx	no fix listed	UBUNTU-CVE-2026-42926
Ubuntu:26.04:LTS	nginx	no fix listed	UBUNTU-CVE-2026-42926

Affected products (as reported)

Vendor	Product	Versions
F5	NGINX Open Source	1.29.4 – before 1.30.1

Weakness: CWE-172 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

References

https://my.f5.com/manage/s/article/K000161131 vendor-advisory, patch