CVE-2026-42926

A flaw was found in NGINX Open Source. When NGINX is configured to proxy HTTP/2 traffic and uses proxy_set_body, a remote attacker may be able to inject malicious data into the upstream peer. This could lead to unintended data manipulation or bypass of security controls.

A moderate severity flaw was found in NGINX Open Source, which is shipped in Red Hat Enterprise Linux 8, 9, and 10 (including the nginx:1.24 and nginx:1.26 module streams) and Red Hat In-Vehicle OS 2.0. When NGINX is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2 and also uses the proxy_set_body directive, a remote attacker may be able to inject HTTP/2 frame headers and payload bytes to the upstream peer, potentially leading to unintended data manipulation or bypass of security controls. Exploitation requires this specific configuration combination, which limits exposure to deployments that use both directives together. For the affected Red Hat Enterprise Linux and Red Hat In-Vehicle OS streams, fixes are currently deferred, so no update is scheduled at this time and the residual risk remains for deployments using the affected configuration; several Red Hat Enterprise Linux streams are out of support scope and will not receive a fix. Red Hat Hardened Images and Fedora are also affected, with fixes pursued through those channels. Red Hat and upstream both rate this flaw as moderate severity (Red Hat CVSS 5.8, upstream CVSS 6.3).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, avoid configuring NGINX to proxy HTTP/2 traffic with the proxy_http_version 2 directive in conjunction with proxy_set_body. If HTTP/2 proxying is essential, ensure that all proxied content is thoroughly validated to prevent malicious data injection. Modifying NGINX configuration files typically requires a service reload or restart for changes to take effect.