HTTP/2 upstream frame injection via oversized proxy_set_body (CVE-2026-42926)

Metric values as published in the disclosure vector. Meters show how far each value raises exposure.

1. Source · attacker-controlledsrc/http/modules/ngx_http_proxy_module.c:879

   ngx_http_proxy_handler() (proxy_http_version 2 dispatch)

2. 1
   Step 01src/http/modules/ngx_http_proxy_module.c:195-200,599-604,879-880

   proxy_http_version 2 is a valid proxy configuration value. When selected, the normal proxy handler dispatches the request into the HTTP/2 upstream implementation.

   static ngx_conf_enum_t  ngx_http_proxy_http_version[] = {
       { ngx_string("1.0"), NGX_HTTP_VERSION_10 },
       { ngx_string("1.1"), NGX_HTTP_VERSION_11 },
   #if (NGX_HTTP_V2)
       { ngx_string("2"), NGX_HTTP_VERSION_20 },
   #endif
       { ngx_null_string, 0 }
   };
   
   /* directive */
   { ngx_string("proxy_http_version"),
     NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
     ngx_conf_set_enum_slot,
     NGX_HTTP_LOC_CONF_OFFSET,
     offsetof(ngx_http_proxy_loc_conf_t, http_version),
     &ngx_http_proxy_http_version },
   
   if (plcf->http_version == NGX_HTTP_VERSION_20) {
       return ngx_http_proxy_v2_handler(r);
   }
   

3. 2
   Step 02src/http/modules/ngx_http_proxy_module.c:343-348,4058-4070

   proxy_set_body stores a configured complex value in body_source, then compiles it into body_lengths and body_values. Those script arrays can include request-derived variables, so the generated body length and bytes can depend on attacker-controlled input.

   { ngx_string("proxy_set_body"),
     NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
     ngx_conf_set_str_slot,
     NGX_HTTP_LOC_CONF_OFFSET,
     offsetof(ngx_http_proxy_loc_conf_t, body_source),
     NULL },
   
   if (conf->body_source.data && conf->body_lengths == NULL) {
       ngx_memzero(&sc, sizeof(ngx_http_script_compile_t));
   
       sc.cf = cf;
       sc.source = &conf->body_source;
       sc.flushes = &conf->body_flushes;
       sc.lengths = &conf->body_lengths;
       sc.values = &conf->body_values;
       sc.complete_lengths = 1;
       sc.complete_values = 1;
   
       if (ngx_http_script_compile(&sc) != NGX_OK) {
           return NGX_CONF_ERROR;
       }
   }
   

4. 3
   Step 03src/http/modules/ngx_http_proxy_v2_module.c:449-463 (before fix)

   In the vulnerable HTTP/2 request builder, body_len is computed from proxy_set_body scripts and added to the initial upstream buffer size, together with one DATA frame header. No upper bound is checked against the HTTP/2 24-bit frame length field.

   body_len = 0;
   
   if (plcf->body_lengths) {
       le.ip = plcf->body_lengths->elts;
       le.request = r;
       le.flushed = 1;
   
       while (*(uintptr_t *) le.ip) {
           lcode = *(ngx_http_script_len_code_pt *) le.ip;
           body_len += lcode(&le);
       }
   
       ctx->ctx.internal_body_length = body_len;
   
       len += sizeof(ngx_http_proxy_v2_frame_t);
       len += body_len;
   

5. 4
   Step 04src/http/modules/ngx_http_proxy_v2_module.c:837-863 (before fix)

   The vulnerable sink serializes body_len into only three length bytes, marks the DATA frame as END_STREAM, and then writes the full generated body immediately after the frame header.

   if (plcf->body_values) {
       f = (ngx_http_proxy_v2_frame_t *) b->last;
       b->last += sizeof(ngx_http_proxy_v2_frame_t);
   
       f->length_0 = (u_char) ((body_len >> 16) & 0xff);
       f->length_1 = (u_char) ((body_len >> 8) & 0xff);
       f->length_2 = (u_char) (body_len & 0xff);
       f->type = NGX_HTTP_V2_DATA_FRAME;
       f->flags = NGX_HTTP_V2_END_STREAM_FLAG;
       f->stream_id_0 = 0;
       f->stream_id_1 = 0;
       f->stream_id_2 = 0;
       f->stream_id_3 = 1;
   
       e.ip = plcf->body_values->elts;
       e.pos = b->last;
       e.request = r;
       e.flushed = 1;
       e.skip = 0;
   
       while (*(uintptr_t *) e.ip) {
           code = *(ngx_http_script_code_pt *) e.ip;
           code((ngx_http_script_engine_t *) &e);
       }
   
       b->last = e.pos;
   }
   

6. 5
   Step 05src/http/modules/ngx_http_proxy_v2_module.c:991-1030 (before fix)

   The first upstream buffer is treated as preframed headers and sent as-is. Because the oversized proxy_set_body DATA frame was embedded in that same buffer, it bypassed the later output filter logic that would normally split request body data into valid HTTP/2 DATA frames.

   if (!ctx->header_sent) {
       /* first buffer contains headers */
   
       ctx->header_sent = 1;
   
       if (ctx->id != 1) {
           /* keepalive connection: skip connection preface,
            * update stream identifiers */
           b = ctx->in->buf;
           b->pos += sizeof(ngx_http_proxy_v2_connection_start) - 1;
           /* ... rewrite frame stream IDs ... */
       }
   
       if (ctx->in->buf->last_buf) {
           ctx->output_closed = 1;
       }
   
       *ll = ctx->in;
       ll = &ctx->in->next;
   
       ctx->in = ctx->in->next;
   }
   

7. 6
   Step 06src/http/modules/ngx_http_proxy_v2_module.c:875-904,1091-1168 (fix)

   Commit c24fb25 creates a separate body buffer for proxy_set_body output and lets the existing HTTP/2 body output filter frame it in chunks capped by NGX_HTTP_V2_DEFAULT_FRAME_SIZE and current flow-control windows.

   /* create_request(): generated body becomes a request body buffer */
   } else if (body_len) {
   
       u->request_bufs = cl;
   
       b = ngx_create_temp_buf(r->pool, body_len);
       if (b == NULL) {
           return NGX_ERROR;
       }
   
       cl->next = ngx_alloc_chain_link(r->pool);
       if (cl->next == NULL) {
           return NGX_ERROR;
       }
   
       cl = cl->next;
       cl->buf = b;
   
       e.ip = plcf->body_values->elts;
       e.pos = b->last;
       e.request = r;
       e.flushed = 1;
       e.skip = 0;
   
       while (*(uintptr_t *) e.ip) {
           code = *(ngx_http_script_code_pt *) e.ip;
           code((ngx_http_script_engine_t *) &e);
       }
   
       b->last = e.pos;
       b->last_buf = 1;
   }
   
   /* body_output_filter(): frame length is bounded */
   pos += ngx_min(NGX_HTTP_V2_DEFAULT_FRAME_SIZE, limit);
   len = (ngx_uint_t) (pos - b->pos);
   
   f->length_0 = (u_char) ((len >> 16) & 0xff);
   f->length_1 = (u_char) ((len >> 8) & 0xff);
   f->length_2 = (u_char) (len & 0xff);
   f->type = NGX_HTTP_V2_DATA_FRAME;
   f->flags = 0;
   

8. Sinksrc/http/modules/ngx_http_proxy_v2_module.c:841

   DATA frame length serialization in ngx_http_proxy_v2_create_request()