---

📌 Executive Snapshot

CVE	Component	Primary Issue	Fixed Open Source Versions	Priority
CVE-2026-28755	ngx_stream_ssl_module	OCSP result bypass in stream mTLS	1.29.7+, 1.28.3+	P3 / P2
CVE-2026-42926	ngx_http_proxy_v2_module	HTTP/2 upstream request injection	1.31.0+, 1.30.1+	P2
CVE-2026-9256	ngx_http_rewrite_module	Heap overflow via overlapping PCRE captures	1.31.1+, 1.30.2+	P1
CVE-2026-42055	ngx_http_proxy_v2_module, ngx_http_grpc_module	Heap overflow with HTTP/2/gRPC large headers	1.31.2+, 1.30.3+	P1
CVE-2026-42533	map directive with regex matching	Heap overflow via regex map capture clobbering	1.31.3+, 1.30.4+	P0/P1

---

🚨 Key Message

These five vulnerabilities are configuration-dependent NGINX data-plane risks.

Risk is highest for:

• Internet-facing reverse proxies
• API gateways
• NGINX Ingress Controller deployments
• gRPC gateways
• HTTP/2 upstream proxying
• Regex-heavy rewrite and map configurations
• Stream mTLS deployments using OCSP validation

Patch first, then audit configuration exposure.

---

🧭 Attack Path Overview

flowchart TD
    A[Remote requester] --> B[Internet-facing NGINX data plane]
    B --> C{Vulnerable configuration present?}
    C -->|stream mTLS + OCSP| D1[CVE-2026-28755]
    C -->|proxy_http_version 2 + proxy_set_body| D2[CVE-2026-42926]
    C -->|rewrite overlapping captures| D3[CVE-2026-9256]
    C -->|gRPC / HTTP2 + large headers| D4[CVE-2026-42055]
    C -->|regex map capture ordering| D5[CVE-2026-42533]
    D1 --> E1[Revoked cert may be accepted]
    D2 --> E2[Upstream HTTP/2 frame injection]
    D3 --> E3[Worker crash or possible code execution]
    D4 --> E3
    D5 --> E3

---

🔥 Threat Intelligence Summary

Item	Result
CISA KEV	Not Found for all five CVEs
Active exploitation	Not Found in reviewed public sources
Ransomware usage	Not Found
APT attribution	Not Found
Exploit-DB	Not Found
Metasploit	Not Found
Public GitHub activity	Found for CVE-2026-42926, CVE-2026-9256, CVE-2026-42055, CVE-2026-42533
Public scanner	Found for CVE-2026-42533
Highest EPSS	CVE-2026-9256 at 0.098840

---

🕒 Disclosure and Patch Timeline

timeline
    title NGINX 2026 CVE Timeline
    2026-03-24 : CVE-2026-28755 fixed in nginx 1.28.3 / 1.29.7
    2026-05-13 : CVE-2026-42926 fixed in nginx 1.30.1 / 1.31.0
    2026-05-22 : CVE-2026-9256 fixed in nginx 1.30.2 / 1.31.1
    2026-06-17 : CVE-2026-42055 fixed in nginx 1.30.3 / 1.31.2
    2026-07-15 : CVE-2026-42533 fixed in nginx 1.30.4 / 1.31.3
    2026-07-28 : CTI package finalized

---

🛠️ Configuration Exposure Checklist

Search NGINX configuration for these directives and patterns:

ssl_verify_client on
ssl_ocsp on
proxy_http_version 2
proxy_set_body
grpc_pass
ignore_invalid_headers off
large_client_header_buffers
rewrite
map
regex captures: $1 $2 $3 ...

High-risk combinations:

CVE	High-risk configuration
CVE-2026-28755	ssl_verify_client on + ssl_ocsp on in stream TLS client-auth deployments
CVE-2026-42926	proxy_http_version 2 + proxy_set_body
CVE-2026-9256	rewrite regex with distinct overlapping PCRE captures and replacement referencing multiple captures
CVE-2026-42055	grpc_pass or proxy_http_version 2 + ignore_invalid_headers off + large_client_header_buffers above 2 MB
CVE-2026-42533	regex map and string expressions referencing regex capture variables in vulnerable order

---

🔎 Detection Ideas

Runtime Signals

nginx worker process exited
exited on signal
segfault
core dumped
CrashLoopBackOff
unexpected 5xx spike

Suspicious Process Behavior

nginx worker process -> sh / bash / curl / wget / nc / ncat / powershell

Network and HTTP Signals

Large HTTP/2 headers
Unexpected gRPC upstream failures
Upstream request desynchronization
TLS client certificate accepted despite OCSP revoked status

---

📊 Risk Matrix

Environment	Risk	Priority	Action
Internet-facing NGINX with regex map exposure	Critical	P0/P1	Upgrade to 1.30.4 / 1.31.3 or fixed Plus release
Internet-facing NGINX with HTTP/2/gRPC large-header exposure	High	P1	Patch and remove unsafe header config
NGINX rewrite rules with overlapping captures	High	P1	Patch and rewrite vulnerable regex patterns
HTTP/2 upstream proxying with proxy_set_body	Medium	P2	Patch or change HTTP upstream version
Stream mTLS with OCSP revocation checks	Medium	P2/P3	Patch and validate revoked cert behavior
NGINX not internet-facing and no vulnerable directives	Low-Medium	P3	Patch in normal cycle and monitor

---

✅ Verified Indicator Status

Indicator Type	Status
Attacker IPs	Not Found
Attacker domains	Not Found
Malicious URLs	Not Found
Malware hashes	Not Found
Registry keys	Not Found
Mutexes	Not Found
Verified scanner filename	nginx_capture_clobber_scan.py for CVE-2026-42533
Key process	nginx, nginx: worker process
Key config files	nginx.conf, files under conf.d/, stream/http server blocks

---

📚 Full Report

The complete enterprise CTI report is available here:

➡️ NGINX_2026_CVE_CTI_Report.md

It includes:

• Official CVE identification
• CVSS, EPSS, KEV status
• Technical analysis
• CPE and affected product validation
• Exploit maturity assessment
• Threat actor likelihood analysis
• IOC table
• MITRE ATT&CK mapping
• ATT&CK data sources
• Detection coverage matrix
• Sigma ideas with validation status
• Wazuh guidance
• Splunk SPL
• Microsoft Sentinel KQL
• Snort/Suricata concepts
• ATT&CK Navigator layer snippet
• STIX 2.1 export snippet
• MISP event export snippet
• Evidence provenance table
• Intelligence gaps
• Assumptions and limitations

---

🔗 Primary References

• nginx security advisories: https://nginx.org/en/security_advisories.html
• nginx 2026 news: https://nginx.org/2026.html
• F5 CVE-2026-42926 advisory: https://my.f5.com/manage/s/article/K000161131
• F5 CVE-2026-42055 advisory: https://my.f5.com/manage/s/article/K000161584
• F5 CVE-2026-42533 advisory: https://my.f5.com/manage/s/article/K000162097
• CVE Services API: https://cveawg.mitre.org/api/cve/
• FIRST EPSS API: https://api.first.org/data/v1/epss
• CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• CVE-2026-42533 static scanner: https://github.com/0xCyberstan/CVE-2026-42533-Config-Scanner

---