flowchart TD
    A[Remote requester] --> B[Internet-facing NGINX data plane]
    B --> C{Vulnerable configuration present?}
    C -->|stream mTLS + OCSP| D1[CVE-2026-28755]
    C -->|proxy_http_version 2 + proxy_set_body| D2[CVE-2026-42926]
    C -->|rewrite overlapping captures| D3[CVE-2026-9256]
    C -->|gRPC / HTTP2 + large headers| D4[CVE-2026-42055]
    C -->|regex map capture ordering| D5[CVE-2026-42533]
    D1 --> E1[Revoked cert may be accepted]
    D2 --> E2[Upstream HTTP/2 frame injection]
    D3 --> E3[Worker crash or possible code execution]
    D4 --> E3
    D5 --> E3

timeline
    title NGINX 2026 CVE Timeline
    2026-03-24 : CVE-2026-28755 fixed in nginx 1.28.3 / 1.29.7
    2026-05-13 : CVE-2026-42926 fixed in nginx 1.30.1 / 1.31.0
    2026-05-22 : CVE-2026-9256 fixed in nginx 1.30.2 / 1.31.1
    2026-06-17 : CVE-2026-42055 fixed in nginx 1.30.3 / 1.31.2
    2026-07-15 : CVE-2026-42533 fixed in nginx 1.30.4 / 1.31.3
    2026-07-28 : CTI package finalized

ssl_verify_client on
ssl_ocsp on
proxy_http_version 2
proxy_set_body
grpc_pass
ignore_invalid_headers off
large_client_header_buffers
rewrite
map
regex captures: $1 $2 $3 ...

nginx worker process exited
exited on signal
segfault
core dumped
CrashLoopBackOff
unexpected 5xx spike

nginx worker process -> sh / bash / curl / wget / nc / ncat / powershell

Large HTTP/2 headers
Unexpected gRPC upstream failures
Upstream request desynchronization
TLS client certificate accepted despite OCSP revoked status