CVE-2026-1642

EUVD-2026-5498
A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response from an upstream proxied server.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.9 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
f5CNA
5.9 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 2%
Affected Products (NVD)
VendorProductVersion
f5nginx_gateway_fabric
1.2.0 ≤
𝑥
≤ 1.6.2
f5nginx_gateway_fabric
2.0.0 ≤
𝑥
< 2.4.1
f5nginx_ingress_controller
3.4.0 ≤
𝑥
≤ 3.7.2
f5nginx_ingress_controller
4.0.0 ≤
𝑥
≤ 4.0.1
f5nginx_ingress_controller
5.0.0 ≤
𝑥
< 5.3.3
f5nginx_instance_manager
2.15.1 ≤
𝑥
≤ 2.21.0
f5nginx_open_source
1.3.0 ≤
𝑥
< 1.28.2
f5nginx_open_source
1.29.0 ≤
𝑥
< 1.29.5
f5nginx_plus
r33 ≤
𝑥
< r35
𝑥
= Vulnerable software versions