On 17 June 2026 nginx released stable 1.30.3 and mainline 1.31.2. They fix a buffer overflow in ngx_http_proxy_v2_module and ngx_http_grpc_module (CVE-2026-42055, rated medium), a buffer overread in ngx_http_charset_module (CVE-2026-48142, low) and, in mainline only, a use after free in ngx_http_v3_module (CVE-2026-42530, rated major).
The Tenable plugin description for the first bug says it is reachable only when proxy_http_version 2 or grpc_pass is used, with ignore_invalid_headers off and large_client_header_buffers configured above 2 megabytes. That is a narrow condition, and a good example of reachability being a config question as much as a code question.
What's affected
| CVE | Severity | Affected | Fixed |
|---|---|---|---|
| CVE-2026-42055 | medium | 1.13.10 to 1.31.1 | 1.31.2 and 1.30.3 |
| CVE-2026-48142 | low | 0.3.50 to 1.31.1 | 1.31.2 and 1.30.3 |
| CVE-2026-42530 | major | 1.31.0 to 1.31.1 | 1.31.2 |
The Tenable description puts the impact of CVE-2026-42055 at a worker process restart, and possibly code execution where ASLR is disabled. Later releases (1.30.4 and 1.31.3 on 15 July, 1.31.4 on 19 August) fix other issues, so target the current build rather than 1.30.3.
How to check if you're exposed
nginx -v
nginx -V 2>&1 | tr ' ' '\n' | grep -E "http_v3|grpc|charset"
# effective config, all includes
nginx -T 2>/dev/null | grep -nE "grpc_pass|proxy_http_version +2|ignore_invalid_headers|large_client_header_buffers|listen .*quic|http3|charset"
Interpretation:
- No
grpc_passand noproxy_http_version 2: the overflow in CVE-2026-42055 is not on a path your config uses. ignore_invalid_headers offtogether with a large header buffer: both conditions in the description are met, so treat it as reachable.- A
listen ... quicline on mainline 1.31.0 or 1.31.1: CVE-2026-42530 applies. Stable 1.30.x is not affected by that one. - A location with
source_charset utf-8and a charset conversion directive, serving or proxying content: CVE-2026-48142.
What to do now
- Upgrade to the current stable or mainline build, not just 1.30.3 or 1.31.2.
- Use
nginx -Toutput as your exposure record, and store it with the ticket. - If you cannot upgrade yet, set
large_client_header_buffersback to modest values and leaveignore_invalid_headerson, which removes the conditions in the description. - If you run mainline with HTTP/3 and are on 1.31.0 or 1.31.1, prioritize.
How this could have been avoided
- Keep default header limits. The bug needs
large_client_header_buffersabove 2 megabytes. Defaults are small for a reason. - Leave
ignore_invalid_headerson. It is the default, and the condition needs it turned off. - Use stable, not mainline, where you can. The HTTP/3 use after free affected only 1.31.0 and 1.31.1.
- Deploy config through version control and test it.
nginx -Tdiffs catch drift from the safe defaults before it ships.
Why it matters
A version scanner sees nginx 1.30.2 and reports a finding. A config aware check sees that the module is compiled in but the directives are off, and ranks it lower. Both are right, in different ways: the first tells you to patch, the second tells you when.
That is the shape of reachability: a function is in the binary, but your configuration decides whether a request can get there.
Try it yourself
Run nginx -T on one server and mark each of the three CVEs reachable, not reachable or unknown.
Click through it at your own pace, or open it full screen.
Quick check
Which configuration makes CVE-2026-42055 reachable?
Per Tenable's description: proxy_http_version 2 or grpc_pass, with ignore_invalid_headers off and large_client_header_buffers above 2 megabytes.
