A critical heap overflow vulnerability has been disclosed in Nginx versions 1.26.0 through 1.26.4. The flaw resides in the HTTP/2 frame processing logic and can be triggered by a malformed HEADERS frame sent by an unauthenticated remote client.

Technical Details

The vulnerability is caused by an integer underflow in the calculation of the allocated buffer size for compressed HTTP/2 headers. Under specific conditions, the underflow causes the subsequent heap allocation to be smaller than the data written into it, resulting in a classic heap overflow.

An attacker can craft a sequence of valid, then malformed, HEADERS frames to influence heap layout prior to triggering the overflow. Proof-of-concept code is not publicly known at this time, but the primitive is considered reliable given the deterministic allocation pattern in Nginx's event loop.

Affected Versions

  • Nginx 1.26.0 through 1.26.4 (mainline)
  • Nginx Plus R32 through R34 (commercial)

Nginx 1.24.x (stable branch) is NOT affected.

Patch

Nginx 1.26.5 and Nginx Plus R35 address this vulnerability. Update immediately.

Mitigations

If immediate patching is not possible:

  • Disable HTTP/2 (http2 off; in server block)
  • Rate-limit HEADERS frame frequency using an upstream WAF
  • Restrict HTTP/2 to authenticated client certificate sessions