CVE-2026-1642

CWE-349CWE-345CWE-476 — NULL Pointer Dereference12 documents9 sources
Severity
8.2HIGH
EPSS
0.0%
top 96.20%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
F5 Nginx Open SourceF5 Nginx PlusF5 Nginx Gateway Fabric+2 more
Timeline
PublishedFeb 4
Latest updateMar 25

Description

A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response from an upstream proxied server. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Affected Packages8 packages

▶CVEListV5f5/nginx_plusR36 — R36 P2+4
▶NVDf5/nginx_plusr33 — r35+5
▶CVEListV5f5/nginx_open_source1.3.0 — 1.29.5
▶NVDf5/nginx_open_source1.3.0 — 1.28.2+1
▶NVDf5/nginx_gateway_fabric2.0.0 — 2.4.1+1

🔴Vulnerability Details

4
OSV
wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()↗2026-03-25
▶
CVEList
NGINX vulnerability↗2026-02-04
▶
GHSA
GHSA-7chh-rv6q-8pp3: A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers↗2026-02-04
▶
OSV
CVE-2026-1642: A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers↗2026-02-04
▶

📋Vendor Advisories

5
Red Hat
kernel: wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()↗2026-03-25
▶
Ubuntu
nginx vulnerability↗2026-02-12
▶
Red Hat
nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections↗2026-02-04
▶
F5
CVE-2026-1642: A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS...↗2026-02-04
▶
Debian
CVE-2026-1642: nginx - A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to u...↗2026
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-1642 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶