chpratik/nginx_2026_cve_bundle_cti_reportCovered CVEs: CVE-2026-28755, CVE-2026-42926, CVE-2026-9256, CVE-2026-42055, CVE-2026-42533
| CVE | Component | Primary Issue | Fixed Open Source Versions | Priority |
|---|
| CVE-2026-28755 | ngx_stream_ssl_module | OCSP result bypass in stream mTLS | 1.29.7+, 1.28.3+ | P3 / P2 |
| CVE-2026-42926 | ngx_http_proxy_v2_module | HTTP/2 upstream request injection | 1.31.0+, 1.30.1+ | P2 |
| CVE-2026-9256 | ngx_http_rewrite_module | Heap overflow via overlapping PCRE captures | 1.31.1+, 1.30.2+ | P1 |
| CVE-2026-42055 | ngx_http_proxy_v2_module, ngx_http_grpc_module | Heap overflow with HTTP/2/gRPC large headers | 1.31.2+, 1.30.3+ | P1 |
| CVE-2026-42533 | map directive with regex matching | Heap overflow via regex map capture clobbering | 1.31.3+, 1.30.4+ | P0/P1 |
These five vulnerabilities are configuration-dependent NGINX data-plane risks.
Risk is highest for:
rewrite and map configurationsPatch first, then audit configuration exposure.
flowchart TD
A[Remote requester] --> B[Internet-facing NGINX data plane]
B --> C{Vulnerable configuration present?}
C -->|stream mTLS + OCSP| D1[CVE-2026-28755]
C -->|proxy_http_version 2 + proxy_set_body| D2[CVE-2026-42926]
C -->|rewrite overlapping captures| D3[CVE-2026-9256]
C -->|gRPC / HTTP2 + large headers| D4[CVE-2026-42055]
C -->|regex map capture ordering| D5[CVE-2026-42533]
D1 --> E1[Revoked cert may be accepted]
D2 --> E2[Upstream HTTP/2 frame injection]
D3 --> E3[Worker crash or possible code execution]
D4 --> E3
D5 --> E3| Item | Result |
|---|---|
| CISA KEV | Not Found for all five CVEs |
| Active exploitation | Not Found in reviewed public sources |
| Ransomware usage | Not Found |
| APT attribution | Not Found |
| Exploit-DB | Not Found |
| Metasploit | Not Found |
| Public GitHub activity | Found for CVE-2026-42926, CVE-2026-9256, CVE-2026-42055, CVE-2026-42533 |
| Public scanner | Found for CVE-2026-42533 |
| Highest EPSS | CVE-2026-9256 at 0.098840 |
timeline
title NGINX 2026 CVE Timeline
2026-03-24 : CVE-2026-28755 fixed in nginx 1.28.3 / 1.29.7
2026-05-13 : CVE-2026-42926 fixed in nginx 1.30.1 / 1.31.0
2026-05-22 : CVE-2026-9256 fixed in nginx 1.30.2 / 1.31.1
2026-06-17 : CVE-2026-42055 fixed in nginx 1.30.3 / 1.31.2
2026-07-15 : CVE-2026-42533 fixed in nginx 1.30.4 / 1.31.3
2026-07-28 : CTI package finalizedSearch NGINX configuration for these directives and patterns:
ssl_verify_client on
ssl_ocsp on
proxy_http_version 2
proxy_set_body
grpc_pass
ignore_invalid_headers off
large_client_header_buffers
rewrite
map
regex captures: $1 $2 $3 ...
High-risk combinations:
| CVE | High-risk configuration |
|---|---|
| CVE-2026-28755 | ssl_verify_client on + ssl_ocsp on in stream TLS client-auth deployments |
| CVE-2026-42926 | proxy_http_version 2 + proxy_set_body |
| CVE-2026-9256 | rewrite regex with distinct overlapping PCRE captures and replacement referencing multiple captures |
| CVE-2026-42055 | grpc_pass or proxy_http_version 2 + ignore_invalid_headers off + large_client_header_buffers above 2 MB |
| CVE-2026-42533 | regex map and string expressions referencing regex capture variables in vulnerable order |
nginx worker process exited
exited on signal
segfault
core dumped
CrashLoopBackOff
unexpected 5xx spike
nginx worker process -> sh / bash / curl / wget / nc / ncat / powershell
Large HTTP/2 headers
Unexpected gRPC upstream failures
Upstream request desynchronization
TLS client certificate accepted despite OCSP revoked status
| Environment | Risk | Priority | Action |
|---|---|---|---|
| Internet-facing NGINX with regex map exposure | Critical | P0/P1 | Upgrade to 1.30.4 / 1.31.3 or fixed Plus release |
| Internet-facing NGINX with HTTP/2/gRPC large-header exposure | High | P1 | Patch and remove unsafe header config |
| NGINX rewrite rules with overlapping captures | High | P1 | Patch and rewrite vulnerable regex patterns |
HTTP/2 upstream proxying with proxy_set_body | Medium | P2 | Patch or change HTTP upstream version |
| Stream mTLS with OCSP revocation checks | Medium | P2/P3 | Patch and validate revoked cert behavior |
| NGINX not internet-facing and no vulnerable directives | Low-Medium | P3 | Patch in normal cycle and monitor |
| Indicator Type | Status |
|---|---|
| Attacker IPs | Not Found |
| Attacker domains | Not Found |
| Malicious URLs | Not Found |
| Malware hashes | Not Found |
| Registry keys | Not Found |
| Mutexes | Not Found |
| Verified scanner filename | nginx_capture_clobber_scan.py for CVE-2026-42533 |
| Key process | nginx, nginx: worker process |
| Key config files | nginx.conf, files under conf.d/, stream/http server blocks |
The complete enterprise CTI report is available here:
It includes:
Patch NGINX. Audit directives. Watch worker crashes. Treat edge proxies as critical infrastructure.