CVE-2026-1642

EUVD-2026-5498

04.02.2026, 15:16

A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response from an upstream proxied server.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	5.9 MEDIUM	NETWORK	HIGH	NONE	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 27.05%

Affected Products (NVD)

Vendor	Product	Version
f5	nginx_gateway_fabric	1.2.0 ≤ 𝑥 ≤ 1.6.2
f5	nginx_gateway_fabric	2.0.0 ≤ 𝑥 < 2.4.1
f5	nginx_ingress_controller	3.4.0 ≤ 𝑥 ≤ 3.7.2
f5	nginx_ingress_controller	4.0.0 ≤ 𝑥 ≤ 4.0.1
f5	nginx_ingress_controller	5.0.0 ≤ 𝑥 < 5.3.3
f5	nginx_instance_manager	2.15.1 ≤ 𝑥 ≤ 2.21.0
f5	nginx_open_source	1.3.0 ≤ 𝑥 < 1.28.2
f5	nginx_open_source	1.29.0 ≤ 𝑥 < 1.29.5
f5	nginx_plus	r33 ≤ 𝑥 < r35

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

nginx

bookworm	1.22.1-9+deb12u9 fixed
bookworm (security)	1.22.1-9+deb12u9 fixed
bullseye	vulnerable
bullseye (security)	1.18.0-6.1+deb11u8 fixed
forky	1.30.4-3 fixed
sid	1.30.4-5 fixed
trixie	1.26.3-3+deb13u7 fixed
trixie (security)	1.26.3-3+deb13u7 fixed

Ubuntu Releases

Ubuntu Product

Codename

nginx

bionic	Fixed 1.14.0-0ubuntu1.11+esm2 released
focal	Fixed 1.18.0-0ubuntu1.7+esm1 released
jammy	Fixed 1.18.0-6ubuntu14.8 released
noble	Fixed 1.24.0-2ubuntu7.6 released
questing	Fixed 1.28.0-6ubuntu1.1 released
resolute	Fixed 1.28.1-3ubuntu1 released
trusty	Fixed 1.4.6-1ubuntu3.9+esm6 released
xenial	Fixed 1.10.3-0ubuntu0.16.04.5+esm7 released

openSUSE / SLES Releases

openSUSE Product

Release

nginx

suse enterprise sap 15 SP4	1.21.5-150400.3.15.1 fixed
suse enterprise sap 15 SP5	1.21.5-150400.3.15.1 fixed
suse enterprise sap 15 SP7	1.21.5-150600.10.15.1 fixed
suse enterprise server 15 SP4	1.21.5-150400.3.15.1 fixed
suse enterprise server 15 SP5	1.21.5-150400.3.15.1 fixed
suse enterprise server 15 SP6	1.21.5-150600.10.15.1 fixed
suse enterprise server 15 SP7	1.21.5-150600.10.15.1 fixed

nginx-source

suse enterprise sap 15 SP4	1.21.5-150400.3.15.1 fixed
suse enterprise sap 15 SP5	1.21.5-150400.3.15.1 fixed
suse enterprise sap 15 SP7	1.21.5-150600.10.15.1 fixed
suse enterprise server 15 SP4	1.21.5-150400.3.15.1 fixed
suse enterprise server 15 SP5	1.21.5-150400.3.15.1 fixed
suse enterprise server 15 SP6	1.21.5-150600.10.15.1 fixed
suse enterprise server 15 SP7	1.21.5-150600.10.15.1 fixed

Red Hat Enterprise Linux Releases

Red Hat Product

Release

nginx

RHEL 9

2:1.20.1-24.el9_7.1

fixed

nginx-all-modules

RHEL 9

2:1.20.1-24.el9_7.1

fixed

nginx-core

RHEL 9

2:1.20.1-24.el9_7.1

fixed

nginx-filesystem

RHEL 9

2:1.20.1-24.el9_7.1

fixed

nginx-mod-devel

RHEL 9

2:1.20.1-24.el9_7.1

fixed

nginx-mod-http-image-filter

RHEL 9

2:1.20.1-24.el9_7.1

fixed

nginx-mod-http-perl

RHEL 9

2:1.20.1-24.el9_7.1

fixed

nginx-mod-http-xslt-filter

RHEL 9

2:1.20.1-24.el9_7.1

fixed

nginx-mod-mail

RHEL 9

2:1.20.1-24.el9_7.1

fixed

nginx-mod-stream

RHEL 9

2:1.20.1-24.el9_7.1

fixed

Amazon Linux Releases

Amazon Package

Release

nginx

Amazon Linux 2023

1:1.28.2-1.amzn2023.0.1

fixed

nginx-all-modules

Amazon Linux 2023

1:1.28.2-1.amzn2023.0.1

fixed

nginx-core

Amazon Linux 2023

1:1.28.2-1.amzn2023.0.1

fixed

nginx-core-debuginfo

Amazon Linux 2023

1:1.28.2-1.amzn2023.0.1

fixed

nginx-debuginfo

Amazon Linux 2023

1:1.28.2-1.amzn2023.0.1

fixed

nginx-debugsource

Amazon Linux 2023

1:1.28.2-1.amzn2023.0.1

fixed

nginx-filesystem

Amazon Linux 2023

1:1.28.2-1.amzn2023.0.1

fixed

nginx-mod-devel

Amazon Linux 2023

1:1.28.2-1.amzn2023.0.1

fixed

nginx-mod-http-image-filter

Amazon Linux 2023

1:1.28.2-1.amzn2023.0.1

fixed

nginx-mod-http-image-filter-debuginfo

Amazon Linux 2023

1:1.28.2-1.amzn2023.0.1

fixed

nginx-mod-http-perl

Amazon Linux 2023

1:1.28.2-1.amzn2023.0.1

fixed

nginx-mod-http-perl-debuginfo

Amazon Linux 2023

1:1.28.2-1.amzn2023.0.1

fixed

nginx-mod-http-xslt-filter

Amazon Linux 2023

1:1.28.2-1.amzn2023.0.1

fixed

nginx-mod-http-xslt-filter-debuginfo

Amazon Linux 2023

1:1.28.2-1.amzn2023.0.1

fixed

nginx-mod-mail

Amazon Linux 2023

1:1.28.2-1.amzn2023.0.1

fixed

nginx-mod-mail-debuginfo

Amazon Linux 2023

1:1.28.2-1.amzn2023.0.1

fixed

nginx-mod-stream

Amazon Linux 2023

1:1.28.2-1.amzn2023.0.1

fixed

nginx-mod-stream-debuginfo

Amazon Linux 2023

1:1.28.2-1.amzn2023.0.1

fixed

Azure Linux Releases

Azure Package

Release

nginx

Azure Linux 3.0	0:1.28.2-1.azl3 fixed
CBL-Mariner 2.0	0:1.22.1-15.cm2 fixed

Common Weakness Enumeration

Vulnerability Media Exposure

[GERMAN] Splunk SOAR: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Splunk SOAR ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen SQL-Injection Angriff durchzuführen, um einen Cross-Site Scripting Angriff durchzuführen, und um beliebigen Programmcode auszuführen.
Published: 2026-08-19T22:00:00+00:00

References

https://my.f5.com/manage/s/article/K000159824

http://www.openwall.com/lists/oss-security/2026/02/05/1