CVE-2026-1642
published 2026-02-04CVE-2026-1642: A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a…
PriorityP336medium5.9CVSS 3.1
AVNACHPRNUINSUCNIHAN
EPSS
0.34%
26.4th percentile
A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response from an upstream proxied server. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected
35 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | nginx | < nginx 1.22.1-9+deb12u4 (bookworm) | nginx 1.22.1-9+deb12u4 (bookworm) |
| f5 | nginx | >= 0 < 1.22.1-9+deb12u4 | 1.22.1-9+deb12u4 |
| f5 | nginx | >= 0 < 1.26.3-3+deb13u2 | 1.26.3-3+deb13u2 |
| f5 | nginx | >= 0 < 1.28.1-3 | 1.28.1-3 |
| f5 | nginx_gateway_fabric | — | — |
| f5 | nginx_gateway_fabric | 1.2.0 – 1.6.2 | — |
| f5 | nginx_gateway_fabric | >= 2.0.0 < 2.4.1 | 2.4.1 |
| f5 | nginx_ingress_controller | — | — |
| f5 | nginx_ingress_controller | 3.4.0 – 3.7.2 | — |
| f5 | nginx_ingress_controller | 4.0.0 – 4.0.1 | — |
| f5 | nginx_ingress_controller | >= 5.0.0 < 5.3.3 | 5.3.3 |
| f5 | nginx_instance_manager | — | — |
| f5 | nginx_instance_manager | 2.15.1 – 2.21.0 | — |
| f5 | nginx_open_source | — | — |
| f5 | nginx_open_source | >= 1.29.0 < 1.29.5 | 1.29.5 |
| f5 | nginx_open_source | >= 1.3.0 < 1.29.5 | 1.29.5 |
| f5 | nginx_open_source | >= 1.3.0 < 1.28.2 | 1.28.2 |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | >= R32 < R32 P4 | R32 P4 |
| f5 | nginx_plus | >= R33 < * | * |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
nvdv4.08.2HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv8.2HIGH
vendor_debian8.2HIGH
vendor_redhat8.2HIGH
vendor_ubuntu6.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
nginx vulnerabilities
vendor_ubuntu·2026-06-03·CVSS 6.3
CVE-2026-1642 [MEDIUM] nginx vulnerabilities
Title: nginx vulnerabilities
Summary: Several security issues were fixed in nginx.
It was discovered that the nginx ngx_mail_smtp_module module incorrectly
handled certain memory operations when doing SMTP authentication. This
could possibly result in sensitive information being sent to the
authentication server. (CVE-2025-53859)
It was discovered that nginx incorrectly handled proxying to upstream TLS
servers. An attacker could possibly use this issue to insert plain text
data into the response from an upstream proxied server. (CVE-2026-1642)
It was discovered that the nginx ngx_mail_auth_http_module module
incorrectly handled certain requests. An attacker could possibly use this
issue to cause nginx to crash, resulting in a denial of service.
(CVE-2026-27651)
It was discovered that
Red Hat
kernel: wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()
vendor_redhat·2026-03-25
CVE-2026-23279 CWE-476 kernel: wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()
kernel: wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()
In mesh_rx_csa_frame(), elems->mesh_chansw_params_ie is dereferenced
at lines 1638 and 1642 without a prior NULL check:
ifmsh->chsw_ttl = elems->mesh_chansw_params_ie->mesh_ttl;
...
pre_value = le16_to_cpu(elems->mesh_chansw_params_ie->mesh_pre_value);
The mesh_matches_local() check above only validates the Mesh ID,
Mesh Configuration, and Supported Rates IEs. It does not verify the
presence of the Mesh Channel Switch Parameters IE (element ID 118).
When a received CSA action frame omits that IE, ieee802_11_parse_elems()
leaves elems->mesh_chansw_params_ie as NULL, and the uncondi
Ubuntu
nginx vulnerability
vendor_ubuntu·2026-02-12
CVE-2026-1642 nginx vulnerability
Title: nginx vulnerability
Summary: nginx could be made to insert content into proxied server data.
It was discovered that nginx incorrectly handled proxying to upstream TLS
servers. An attacker could possibly use this issue to insert plain text
data into the response from an upstream proxied server.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections
vendor_redhat·2026-02-04·CVSS 8.2
CVE-2026-1642 [HIGH] CWE-349 nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections
nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections
A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response from an upstream proxied server. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
A flaw was found in NGINX. When NGINX is configured to proxy to upstream Transport Layer Security (TLS) servers, An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject p
F5
CVE-2026-1642: A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS...
vendor_f5·2026-02-04·CVSS 5.9
CVE-2026-1642 [HIGH] CWE-345 CVE-2026-1642: A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS...
CVE-2026-1642: A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS...
A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response from an upstream proxied server. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected Products: NGINX Ingress Controller, NGINX Plus, Nginx Gateway Fabric, Nginx Instance Manager, Nginx Open Source
Affected Versions: 1.2.0 - 1.6.2; 1.29.0 - 1.29.5; 1.3.0 - 1.28.2; 2.0.0 - 2.4.1; 2.15.1 - 2.21.0
Debian
CVE-2026-1642: nginx - A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to u...
vendor_debian·2026·CVSS 8.2
CVE-2026-1642 [HIGH] CVE-2026-1642: nginx - A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to u...
A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response from an upstream proxied server. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Scope: local
bookworm: resolved (fixed in 1.22.1-9+deb12u4)
bullseye: open
forky: resolved (fixed in 1.28.1-3)
sid: resolved (fixed in 1.28.1-3)
trixie: resolved (fixed in 1.26.3-3+deb13u2)
OSV
wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()
osv·2026-03-25
CVE-2026-23279 wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()
wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()
In mesh_rx_csa_frame(), elems->mesh_chansw_params_ie is dereferenced
at lines 1638 and 1642 without a prior NULL check:
ifmsh->chsw_ttl = elems->mesh_chansw_params_ie->mesh_ttl;
...
pre_value = le16_to_cpu(elems->mesh_chansw_params_ie->mesh_pre_value);
The mesh_matches_local() check above only validates the Mesh ID,
Mesh Configuration, and Supported Rates IEs. It does not verify the
presence of the Mesh Channel Switch Parameters IE (element ID 118).
When a received CSA action frame omits that IE, ieee802_11_parse_elems()
leaves elems->mesh_chansw_params_ie as NULL, and the uncondition
GHSA
GHSA-7chh-rv6q-8pp3: A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers
ghsa_unreviewed·2026-02-04
CVE-2026-1642 [HIGH] CWE-345 GHSA-7chh-rv6q-8pp3: A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers
A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response from an upstream proxied server. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
OSV
CVE-2026-1642: A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers
osv·2026-02-04·CVSS 8.2
CVE-2026-1642 [HIGH] CVE-2026-1642: A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers
A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response from an upstream proxied server. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
No detection rules found.
No public exploits indexed.
Wiz
CVE-2025-14727 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.1
CVE-2025-14727 [HIGH] CVE-2025-14727 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-14727 :
NGINX Ingress Controller (NGINX Inc) vulnerability analysis and mitigation
A vulnerability exists in NGINX Ingress Controller's nginx.org/rewrite-target annotation validation.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Source : NVD
## 8.7
Score
Published December 17, 2025
Severity HIGH
CNA Score 8.7
Affected Technologies
NGINX Ingress Controller (NGINX Inc)
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 41
Exploitation Probability (EPSS) 0.2
Affected packages and libraries
cpe:2.3:a:f5:nginx_ingress_controller
Sources
Linux Severity HIGH Has Fix Added at: Dec 18, 2025
Linux Severity HIGH Has Fix Added at: Ja
Wiz
CVE-2026-1642 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.2
CVE-2026-1642 [HIGH] CVE-2026-1642 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-1642 :
NGINX vulnerability analysis and mitigation
A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response from an upstream proxied server. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Source : NVD
## 8.2
Score
Published February 4, 2026
Severity HIGH
CNA Score 8.2
Affected Technologies
NGINX
Rocky Linux
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 3.4
Exploitation
Bugzilla
CVE-2026-1642 nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections
bugzilla·2026-02-04·CVSS 8.2
CVE-2026-1642 [HIGH] CVE-2026-1642 nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections
CVE-2026-1642 nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections
A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response from an upstream proxied server. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2026:3638 https://access.redhat.com/errata/RHSA-2026:3638
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux
2026-02-04
Published