A heap buffer overflow vulnerability in NGINX’s chunked transfer encoding handler has been discovered and assigned CVE-2026-42945 (CVSS 9.2). The flaw has been present since NGINX version 0.6.27, released in 2008, meaning every NGINX version deployed in production over the past 18 years is technically affected. The vulnerability is present in NGINX mainline and stable branches, as well as commercial NGINX Plus, and affects NGINX’s widespread role as a web server, reverse proxy, load balancer, and API gateway.
Technical Detail
The vulnerability exists in how NGINX parses HTTP/1.1 chunked transfer encoding when processing certain malformed chunk size values. A specially crafted HTTP request containing a chunked body with an oversized chunk size indicator triggers a heap buffer overflow in the chunk size parsing code, corrupting adjacent memory allocations.
The primary confirmed impact is a reliable denial-of-service — a single malformed request can crash the NGINX worker process. Under specific heap layout conditions achievable through heap grooming with preceding legitimate requests, the overflow can potentially be converted to code execution, though no public RCE PoC has been demonstrated at time of writing.
The chunked transfer encoding parsing path is exercised by any HTTP/1.1 client that uses chunked request bodies — including standard clients performing file uploads, API frameworks using streaming request payloads, and HTTP/1.1 proxied traffic.
Scope
NGINX’s market share makes this vulnerability exceptionally wide-reaching:
- Approximately 34% of all websites run NGINX
- NGINX is embedded in hundreds of commercial appliances and products as a bundled component
- NGINX Plus is deployed as an API gateway and load balancer in many enterprise environments
- Kubernetes ingress controllers commonly use NGINX (nginx-ingress-controller)
Products embedding NGINX — including Citrix ADC in proxy mode, F5 NGINX Plus appliances, and various cloud-native load balancer products — may require vendor-specific patches rather than direct NGINX updates.
Recommended Actions
- Update NGINX immediately: Apply the patched NGINX version (1.27.5 stable / 1.28.0 mainline or later). On Debian/Ubuntu:
apt update && apt upgrade nginx. On RHEL/CentOS:yum update nginx. - Commercial products: If running NGINX Plus, apply the F5/NGINX Plus security patch. Check with your appliance vendors for any products embedding NGINX.
- Kubernetes ingress: Update the nginx-ingress-controller Helm chart or Kubernetes deployment to the latest version containing the patched NGINX binary.
- Temporary mitigation: If patching must be delayed, consider implementing a WAF rule that rejects requests with malformed chunked transfer encoding. This is a mitigation, not a fix.
- API gateways: Organisations running NGINX as an API gateway (NGINX Plus with API Management) should apply the patch with priority, as API gateways typically face external traffic from a broad range of clients.
Share this article