CVE-2026-42926

MediumCVSS 5.8/10Last modified Oct 26, 2026

Description

When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also uses proxy_set_body, an attacker may be able to inject frame headers and payload bytes to the upstream peer. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Metrics

CVSS 3.1 5.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Weakness enumeration

CWE-172

Affected software

Vendor	Product	Versions
F5	NGINX Open Source	>= 1.29.4, < 1.30.1

References

https://my.f5.com/manage/s/article/K000161131Mitigation, Vendor Advisory

Timeline

Published: May 13, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-429298.3Danelec MacGregor Voyage Data Recorder includes default accounts with hard-coded credentials.CVE-2026-42935.3The affected Kieback & Peter DDC building controllers are vulnerable to cross-site scripting, enabling JavaScript to be executed by the vict CVE-2026-429308.7When running in Appliance mode, an authenticated attacker assigned the 'Administrator' role may be able to bypass Appliance mode restriction CVE-2026-429316.5Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint CVE-2026-429325.3Naxclow device identifiers use fixed manufacturing prefixes combined with sequential counters, producing a fully predictable and enumerable CVE-2026-4293310.0Pronetiqs IntraVUE versions 3.2.1a14 and prior have an unintended proxy or intermediary vulnerability which could allow an attacker to use a CVE-2026-429344.8NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map a CVE-2026-429368.4The installer of HYPER SBI 2 insecurely loads Dynamic Link Libraries. If there is a crafted DLL at the same directory when invoking the affe CVE-2026-429376.5Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tmsh) arp and ndp commands, and in BIG-IP iControl RE CVE-2026-429418.3The Danelec MacGregor Voyage Data Recorder device includes a default username and password, with no enforced password change.CVE-2026-429447.5NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a vulnerability that results in heap overflow when encoding multiple NSID a CVE-2026-429458.1NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite dire