CVE-2026-42926

6.3 medium exploit SSVC exploitation: none Analyzed

When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also uses proxy_set_body, an attacker may be able to inject frame headers and payload bytes to the upstream peer. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Fix

Public exploits 1

ikarolaborda/CVE2026-42926 PoC on GitHub

Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.

Patch, vendor advisory and mitigation references on NVD 1

https://my.f5.com/manage/s/article/K000161131 Mitigation, Vendor Advisory

Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.

Change history 1

2026-10-26 14:29First seenCVSS 6.3 · f5NVD modified 2026-10-26 14:10

Affected (CPE criteria) 4

cpe:2.3:a:f5:nginx_gateway_fabric:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:nginx_open_source:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:nginx_instance_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:*

References 1

https://my.f5.com/manage/s/article/K000161131 Mitigation, Vendor Advisory