Critical NGINX Flaws Expose HTTP/2, gRPC, HTTP/3 and Gateway Fabric Deployments

F5 disclosed multiple high-severity vulnerabilities affecting NGINX Open Source, NGINX Plus, and related products, including a critical heap-based buffer overflow in ngx_http_proxy_v2_module and ngx_http_grpc_module tracked as CVE-2026-42055. The flaw can be triggered remotely without authentication when HTTP/2 proxying or grpc_pass is enabled, ignore_invalid_headers is set to off, and large_client_header_buffers exceeds 2 MB, allowing oversized headers to crash worker processes and potentially enable code execution if ASLR is bypassed. F5 also disclosed CVE-2026-42530, a critical use-after-free in the open-source ngx_http_v3_module that can be exploited through a crafted HTTP/3 QUIC session to reopen a QPACK encoder stream, again causing worker restarts and possible code execution.

A separate issue, CVE-2026-11311, affects NGINX Gateway Fabric when NGINX Plus is used as the data plane, allowing authenticated users with permission to modify relevant CRDs to inject arbitrary NGINX directives through unsanitized values in NginxProxy.serverTokens and AuthenticationFilter.extraAuthArgs. F5's out-of-band advisory said the exposure spans a broad set of products, including NGINX Ingress Controller, NGINX Instance Manager, NGINX App Protect WAF, NGINX App Protect DoS, F5 WAF for NGINX Instance Manager, and F5 DoS for NGINX. Updated releases, including nginx 1.31.2 and the stable branch 1.30.3, were published to address the core NGINX flaws, and defenders were urged to patch affected versions or disable HTTP/3 QUIC where immediate updates are not possible.