CVE-2026-1642
A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response from an upstream proxied server. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.2
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.35%
- CWE
- CWE-349
- Published
- 2026-02-04
- Last modified
- 2026-03-12
Affected products
- F5 NGINX Open Source
- F5 NGINX Plus
- F5 NGINX Plus
- F5 NGINX Plus
- F5 NGINX Plus
- F5 NGINX Plus
Weakness type
Related vulnerabilities
- CVE-2026-15387 — Acceptance of Extraneous Untrusted Data With Trusted Data in GitLab
- CVE-2026-54625 — django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)
- CVE-2026-50252 — Possible cache poisoning attack by mapping source port population per thread
- CVE-2026-41120 — Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Acceptance of Extraneous...
- CVE-2026-46342 — Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning
- CVE-2026-45602 — Windows Dynamic Host Configuration Protocol (DHCP) Tampering Vulnerability
- CVE-2026-42960 — Possible cache poisoning via promiscuous records for the authority section
- CVE-2026-44572 — Next.js: Middleware / Proxy redirects can be cache-poisoned