CVE-2026-1642

NGINX vulnerability

State: Published
Severity: 8.2 High
Published: Feb 4, 2026
Updated: Feb 5, 2026
Reserved: Jan 29, 2026

Description

A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response from an upstream proxied server. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Scores

CVSS	Score	Vector	Source
4.0	8.2 High	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N	f5
3.1	5.9 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N	f5

Weaknesses

CWE-349 Acceptance of Extraneous Untrusted Data With Trusted Data

Affected Products

Product	Versions
NGINX Open SourceF5	1.3.0 to before 1.29.5Affectedfrom 1.28.2Not affected
NGINX PlusF5	R36 to before R36 P2Affected R35 to before R35 P1Affected R34 and laterAffected R33 and laterAffected R32 to before R32 P4Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.