CVE-2026-55233: OpenResty PROXY Protocol DoS Vulnerability

CVE-2026-55233 Overview

CVE-2026-55233 is an out-of-bounds write vulnerability [CWE-787] in OpenResty, a high-performance web platform based on NGINX. The flaw resides in the upstream PROXY protocol version 2 implementation used by the stream module. When OpenResty is configured to emit PROXY protocol v2 headers to upstream servers, header construction can write past the bounds of the allocated buffer. The condition crashes the worker process and results in denial of service. Affected releases span from 1.29.2.1 up to versions before 1.29.2.5. The issue is remediated in OpenResty 1.29.2.5.

Critical Impact
A remote, unauthenticated attacker can trigger worker process crashes on OpenResty servers configured to send PROXY protocol v2 to upstreams, causing service disruption.

Affected Products

OpenResty versions 1.29.2.1 through 1.29.2.4
Deployments explicitly enabling PROXY protocol v2 for upstream connections
NGINX stream module builds using the bundled stream_proxy_protocol_v2 patch

Discovery Timeline

2026-07-10 - CVE-2026-55233 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-55233

Vulnerability Analysis

The vulnerability lives in the OpenResty patch that adds PROXY protocol v2 emission to the NGINX stream module. When OpenResty proxies a stream connection to an upstream server, it constructs a binary PROXY protocol v2 header containing address family, transport, and optional Type-Length-Value (TLV) fields such as SSL metadata and Application-Layer Protocol Negotiation (ALPN). The header build routine writes into a preallocated buffer. Because size validation is incomplete, the serialization logic can write beyond the buffer boundary, corrupting adjacent memory and terminating the worker process.

The crash denies service to all clients handled by that worker. Repeated triggering keeps workers in a restart loop, exhausting connection capacity. Only configurations that explicitly enable PROXY protocol v2 for upstream connections are exposed.

Root Cause

The root cause is missing or incorrect bounds enforcement during PROXY protocol v2 header construction in the stream proxy patch (nginx-1.29.2-stream_proxy_protocol_v2.patch). TLV additions and address family encoding advance a write pointer without verifying that the remaining buffer space is sufficient for the field being appended.

Attack Vector

Exploitation is network-based and requires no authentication or user interaction. An attacker initiates or influences stream connections that transit a vulnerable OpenResty instance forwarding PROXY protocol v2 to an upstream. The malformed or oversized state that drives the overflow occurs during outbound header assembly, so any client-facing connection meeting the trigger conditions can crash the worker.

text

// Excerpt from the security patch hardening PROXY protocol v2 header construction
// File: patches/nginx/1.29.2/nginx-1.29.2-stream_proxy_protocol_v2.patch

+#define NGX_PROXY_PROTOCOL_V2_FAM_INET6        0x20
+
+#define NGX_PROXY_PROTOCOL_V2_TYPE_ALPN             0x01
+#define NGX_PROXY_PROTOCOL_V2_TYPE_AUTHORITY        0x02 /* Not implemented */
+#define NGX_PROXY_PROTOCOL_V2_TYPE_CRC32C           0x03 /* Not implemented */
+#define NGX_PROXY_PROTOCOL_V2_TYPE_NOOP             0x04 /* Not implemented */
+#define NGX_PROXY_PROTOCOL_V2_TYPE_UNIQUE_ID        0x05 /* Not implemented */
+#define NGX_PROXY_PROTOCOL_V2_TYPE_SSL              0x20
+#define NGX_PROXY_PROTOCOL_V2_SUBTYPE_SSL_VERSION   0x21
+#define NGX_PROXY_PROTOCOL_V2_SUBTYPE_SSL_CN        0x22
+#define NGX_PROXY_PROTOCOL_V2_SUBTYPE_SSL_CIPHER    0x23
+#define NGX_PROXY_PROTOCOL_V2_SUBTYPE_SSL_SIG_ALG   0x24
+#define NGX_PROXY_PROTOCOL_V2_SUBTYPE_SSL_KEY_ALG   0x25
+#define NGX_PROXY_PROTOCOL_V2_TYPE_NETNS            0x30 /* Not implemented */

Source: OpenResty GitHub Commit 5c56ad2. The commit hardens the proxy_protocol v2 stream patch against overflow and over-read.

Detection Methods for CVE-2026-55233

Indicators of Compromise

Repeated NGINX worker process crashes with SIGSEGV or SIGABRT signals logged in error.log
Frequent worker respawn events tied to stream contexts using proxy_protocol on toward upstreams
Abnormal termination messages such as worker process ... exited on signal 11 correlated with stream traffic bursts

Detection Strategies

Audit OpenResty and NGINX stream configurations for directives that enable PROXY protocol v2 to upstream servers.
Compare running OpenResty binaries against the vulnerable range 1.29.2.1 through 1.29.2.4 using openresty -v.
Correlate worker crash frequency with connection patterns from untrusted networks.

Monitoring Recommendations

Alert on core dumps produced by OpenResty worker processes and on repeated worker restart cycles.
Ingest error.log into a centralized logging platform and search for signal 11 or signal 6 events from nginx: worker process.
Track upstream connection failure rates for stream services proxied with PROXY protocol v2 enabled.

How to Mitigate CVE-2026-55233

Immediate Actions Required

Upgrade OpenResty to version 1.29.2.5 or later on all hosts running the stream module.
Inventory configurations for the proxy_protocol directive within stream {} blocks and validate the upstream chain.
Restrict network access to stream listeners so only trusted clients can reach affected proxies until patching completes.

Patch Information

The fix is delivered in OpenResty 1.29.2.5. Refer to the OpenResty GitHub Security Advisory GHSA-wx83-v28q-68gx and the remediation commit 5c56ad2 for full details on the hardened PROXY protocol v2 stream patch.

Workarounds

Disable the proxy_protocol directive on affected stream upstream blocks until the upgrade is applied.
Terminate stream connections upstream of OpenResty and forward traffic without PROXY protocol v2 where feasible.
Place a network access control list in front of OpenResty stream listeners to permit only vetted source ranges.

bash

# Verify installed OpenResty version and identify vulnerable builds
openresty -v 2>&1 | grep -E "1\.29\.2\.[1-4]$" && echo "VULNERABLE: upgrade to 1.29.2.5"

# Locate stream configurations that enable PROXY protocol v2 to upstreams
grep -RIn --include='*.conf' -E 'proxy_protocol\s+on;' /usr/local/openresty/nginx/conf/

# Temporary workaround: disable proxy_protocol on the stream proxy directive
# In nginx.conf under stream { server { ... } }:
#     proxy_pass backend;
#     # proxy_protocol on;   # disabled pending upgrade to 1.29.2.5

# Reload configuration after changes
openresty -t && openresty -s reload