Vulnerability · Published Feb 4, 2026 · Assigned by f5
CVE-2026-1642NGINX vulnerability
Medium 5.9
In plain English
A medium-severity security flaw in NGINX Open Source from F5. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.4%top 67.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response from an upstream proxied server. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | nginx | 1:1.24.0-2.module_el8.10.0+4143+ec3e7d32.alma.1 | ALSA-2026:5581 |
| AlmaLinux:9 | nginx | 2:1.26.3-2.module_el9.7.0+215+8d94e91c | ALSA-2026:4235 |
| AlmaLinux:9 | nginx | 1:1.24.0-5.module_el9.7.0+212+9d3c155a.1.alma.1 | ALSA-2026:3638 |
| AlmaLinux:9 | nginx | 2:1.20.1-24.el9_7.1.alma.1 | ALSA-2026:5599 |
| AlmaLinux:10 | nginx-all-modules | 2:1.26.3-2.el10_1 | ALSA-2026:4705 |
| AlmaLinux:8 | nginx-all-modules | 1:1.24.0-2.module_el8.10.0+4143+ec3e7d32.alma.1 | ALSA-2026:5581 |
| AlmaLinux:9 | nginx-all-modules | 2:1.26.3-2.module_el9.7.0+215+8d94e91c | ALSA-2026:4235 |
| AlmaLinux:9 | nginx-all-modules | 1:1.24.0-5.module_el9.7.0+212+9d3c155a.1.alma.1 | ALSA-2026:3638 |
| AlmaLinux:9 | nginx-all-modules | 2:1.20.1-24.el9_7.1.alma.1 | ALSA-2026:5599 |
| AlmaLinux:9 | nginx-core | 2:1.20.1-24.el9_7.1.alma.1 | ALSA-2026:5599 |
| AlmaLinux:9 | nginx-core | 1:1.24.0-5.module_el9.7.0+212+9d3c155a.1.alma.1 | ALSA-2026:3638 |
| AlmaLinux:9 | nginx-core | 2:1.26.3-2.module_el9.7.0+215+8d94e91c | ALSA-2026:4235 |
| AlmaLinux:10 | nginx-filesystem | 2:1.26.3-2.el10_1 | ALSA-2026:4705 |
| AlmaLinux:8 | nginx-filesystem | 1:1.24.0-2.module_el8.10.0+4143+ec3e7d32.alma.1 | ALSA-2026:5581 |
| AlmaLinux:9 | nginx-filesystem | 2:1.26.3-2.module_el9.7.0+215+8d94e91c | ALSA-2026:4235 |
| AlmaLinux:9 | nginx-filesystem | 2:1.20.1-24.el9_7.1.alma.1 | ALSA-2026:5599 |
| AlmaLinux:9 | nginx-filesystem | 1:1.24.0-5.module_el9.7.0+212+9d3c155a.1.alma.1 | ALSA-2026:3638 |
| AlmaLinux:8 | nginx-mod-devel | 1:1.24.0-2.module_el8.10.0+4143+ec3e7d32.alma.1 | ALSA-2026:5581 |
| AlmaLinux:9 | nginx-mod-devel | 2:1.20.1-24.el9_7.1.alma.1 | ALSA-2026:5599 |
| AlmaLinux:9 | nginx-mod-devel | 1:1.24.0-5.module_el9.7.0+212+9d3c155a.1.alma.1 | ALSA-2026:3638 |
| AlmaLinux:9 | nginx-mod-devel | 2:1.26.3-2.module_el9.7.0+215+8d94e91c | ALSA-2026:4235 |
| AlmaLinux:8 | nginx-mod-http-image-filter | 1:1.24.0-2.module_el8.10.0+4143+ec3e7d32.alma.1 | ALSA-2026:5581 |
| AlmaLinux:9 | nginx-mod-http-image-filter | 1:1.24.0-5.module_el9.7.0+212+9d3c155a.1.alma.1 | ALSA-2026:3638 |
| AlmaLinux:9 | nginx-mod-http-image-filter | 2:1.20.1-24.el9_7.1.alma.1 | ALSA-2026:5599 |
| AlmaLinux:9 | nginx-mod-http-image-filter | 2:1.26.3-2.module_el9.7.0+215+8d94e91c | ALSA-2026:4235 |
| AlmaLinux:8 | nginx-mod-http-perl | 1:1.24.0-2.module_el8.10.0+4143+ec3e7d32.alma.1 | ALSA-2026:5581 |
| AlmaLinux:9 | nginx-mod-http-perl | 2:1.20.1-24.el9_7.1.alma.1 | ALSA-2026:5599 |
| AlmaLinux:9 | nginx-mod-http-perl | 1:1.24.0-5.module_el9.7.0+212+9d3c155a.1.alma.1 | ALSA-2026:3638 |
| AlmaLinux:9 | nginx-mod-http-perl | 2:1.26.3-2.module_el9.7.0+215+8d94e91c | ALSA-2026:4235 |
| AlmaLinux:8 | nginx-mod-http-xslt-filter | 1:1.24.0-2.module_el8.10.0+4143+ec3e7d32.alma.1 | ALSA-2026:5581 |
| AlmaLinux:9 | nginx-mod-http-xslt-filter | 2:1.20.1-24.el9_7.1.alma.1 | ALSA-2026:5599 |
| AlmaLinux:9 | nginx-mod-http-xslt-filter | 2:1.26.3-2.module_el9.7.0+215+8d94e91c | ALSA-2026:4235 |
| AlmaLinux:9 | nginx-mod-http-xslt-filter | 1:1.24.0-5.module_el9.7.0+212+9d3c155a.1.alma.1 | ALSA-2026:3638 |
| AlmaLinux:8 | nginx-mod-mail | 1:1.24.0-2.module_el8.10.0+4143+ec3e7d32.alma.1 | ALSA-2026:5581 |
| AlmaLinux:9 | nginx-mod-mail | 2:1.26.3-2.module_el9.7.0+215+8d94e91c | ALSA-2026:4235 |
| AlmaLinux:9 | nginx-mod-mail | 1:1.24.0-5.module_el9.7.0+212+9d3c155a.1.alma.1 | ALSA-2026:3638 |
| AlmaLinux:9 | nginx-mod-mail | 2:1.20.1-24.el9_7.1.alma.1 | ALSA-2026:5599 |
| AlmaLinux:8 | nginx-mod-stream | 1:1.24.0-2.module_el8.10.0+4143+ec3e7d32.alma.1 | ALSA-2026:5581 |
| AlmaLinux:9 | nginx-mod-stream | 1:1.24.0-5.module_el9.7.0+212+9d3c155a.1.alma.1 | ALSA-2026:3638 |
| AlmaLinux:9 | nginx-mod-stream | 2:1.26.3-2.module_el9.7.0+215+8d94e91c | ALSA-2026:4235 |
| AlmaLinux:9 | nginx-mod-stream | 2:1.20.1-24.el9_7.1.alma.1 | ALSA-2026:5599 |
| Alpine:v3.22 | nginx | 1.28.2-r0 | ALPINE-CVE-2026-1642 |
| Alpine:v3.23 | nginx | 1.28.2-r0 | ALPINE-CVE-2026-1642 |
| Alpine:v3.24 | nginx | 1.28.2-r0 | ALPINE-CVE-2026-1642 |
| Debian:12 | nginx | 1.22.1-9+deb12u4 | DEBIAN-CVE-2026-1642 |
| Debian:12 | nginx | 1.22.1-9+deb12u4 | DSA-6131-1 |
| Debian:13 | nginx | 1.26.3-3+deb13u2 | DEBIAN-CVE-2026-1642 |
| Debian:13 | nginx | 1.26.3-3+deb13u2 | DSA-6131-1 |
| Debian:14 | nginx | 1.28.1-3 | DEBIAN-CVE-2026-1642 |
| Rocky Linux:10 | nginx | 2:1.26.3-2.el10_1 | RLSA-2026:4705 |
| Rocky Linux:8 | nginx | 1:1.24.0-2.module+el8.10.0+40137+188e04f4 | RLSA-2026:5581 |
| Rocky Linux:9 | nginx | 2:1.26.3-2.module+el9.7.0+40103+2443f6d1 | RLSA-2026:4235 |
| Rocky Linux:9 | nginx | 1:1.24.0-5.module+el9.7.0+40088+99dbd8cd.1.rocky.0.1 | RLSA-2026:3638 |
| Ubuntu:22.04:LTS | nginx | 1.18.0-6ubuntu14.8 | USN-8038-1 |
| Ubuntu:22.04:LTS | nginx | 1.18.0-6ubuntu14.8 | UBUNTU-CVE-2026-1642 |
| Ubuntu:24.04:LTS | nginx | 1.24.0-2ubuntu7.6 | UBUNTU-CVE-2026-1642 |
| Ubuntu:24.04:LTS | nginx | 1.24.0-2ubuntu7.6 | USN-8038-1 |
| Ubuntu:25.10 | nginx | 1.28.0-6ubuntu1.1 | USN-8038-1 |
| Ubuntu:25.10 | nginx | 1.28.0-6ubuntu1.1 | UBUNTU-CVE-2026-1642 |
| Ubuntu:26.04:LTS | nginx | 1.28.1-3ubuntu1 | UBUNTU-CVE-2026-1642 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| F5 | NGINX Open Source | 1.3.0 – before 1.29.5 |
| F5 | NGINX Plus | R36 – before R36 P2R35 – before R35 P1R34 – before *R33 – before *R32 – before R32 P4 |
Weakness: CWE-349 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N