← Database

CVE-2026-42926

MEDIUM CVSS: 5.8 Published: 2026-05-13 Modified: 2026-06-18

Description

When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also uses proxy_set_body, an attacker may be able to inject frame headers and payload bytes to the upstream peer.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected Platforms

F5 Nginx Ingress ControllerF5 Nginx Instance ManagerF5 Nginx Open SourceF5 Nginx Gateway Fabric

Weakness Type

CWE-172

References