- nginx
- f5
- cve
- http2
- grpc
- heap-overflow
- reverse-proxy
news
NGINX 2026 Data-Plane Multi-CVE Pack (Proxy/Rewrite/Map/OCSP)
CTI pack covering five config-dependent NGINX data-plane CVEs (OCSP bypass, HTTP/2 injection, rewrite/map/gRPC heap overflows); public scanners indexed on Sploitus.
Summary
A July 2026 Sploitus-indexed NGINX multi-CVE investigation pack (author Pratik Chhetri, report date 2026-07-28) aggregates five configuration-dependent data-plane issues affecting NGINX Open Source / Plus. They are distinct from the earlier NGINX Rift rewrite-module line (CVE-2026-42945), though they share the same “internet-facing reverse proxy / Ingress” risk surface.
Public GitHub activity and at least one scanner were noted for several IDs; CISA KEV listings were not found for these five at report time. OFFSITE.DARK indexes the Sploitus CTI card for defenders prioritizing patch + config audit.
CVE pack
| CVE | Component | Issue | Fixed OSS (approx.) | Priority (pack) |
|---|---|---|---|---|
| CVE-2026-28755 | ngx_stream_ssl_module | OCSP result bypass in stream mTLS | 1.29.7+ / 1.28.3+ | P3/P2 |
| CVE-2026-42926 | ngx_http_proxy_v2_module | HTTP/2 upstream request injection | 1.31.0+ / 1.30.1+ | P2 |
| CVE-2026-9256 | ngx_http_rewrite_module | Heap overflow via overlapping PCRE captures | 1.31.1+ / 1.30.2+ | P1 |
| CVE-2026-42055 | proxy_v2 + gRPC modules | Heap overflow with large HTTP/2/gRPC headers | 1.31.2+ / 1.30.3+ | P1 |
| CVE-2026-42533 | map + regex | Heap overflow via regex map capture clobbering | 1.31.3+ / 1.30.4+ | P0/P1 |
Highest EPSS called out in the pack: CVE-2026-9256 (~0.099).
Risk surface
Exposure rises when configs include:
- Internet-facing reverse proxies / API gateways / Ingress Controllers
proxy_http_version 2+ body/header rewriting- gRPC gateways with large headers
- Regex-heavy
rewrite/mapcapture usage - Stream mTLS with OCSP stapling/validation paths
Impact
Worker crash or potential code execution on heap-overflow CVEs; unauthorized acceptance of revoked certs on the OCSP bypass; upstream frame injection on HTTP/2 proxy paths. Impact is config-gated — inventory matters as much as version number.
Mitigation
- Upgrade NGINX Open Source / Plus (and Ingress Controller images) to the fixed trains above.
- Audit for HTTP/2 upstream, gRPC, stream mTLS+OCSP, and overlapping regex capture patterns.
- Prefer vendor-supported Plus/OSS packages over stale static builds in containers.
- Cross-check NGINX Rift if still on rewrite/
setcapture patterns from the May 2026 wave. - Monitor for public scanners targeting CVE-2026-42533 and related PoCs.