CVE-2026-1642

A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response from an upstream proxied server.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response from an upstream proxied server.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

NGINX is a free, open-source, high-performance HTTP server and reverse proxy, as well as an IMAP/POP3 proxy server.

Security Fix(es):

A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response from an upstream proxied server. The vulnerability is classified as CWE-349: The product, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted. This vulnerability primarily affects data integrity.(CVE-2026-1642)

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.

Security Fix(es):

• nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections (CVE-2026-1642)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.

Security Fix(es):

• nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections (CVE-2026-1642)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.

Security Fix(es):

• nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections (CVE-2026-1642)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.

Security Fix(es):

• nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections (CVE-2026-1642)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response from an upstream proxied server.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.

Security Fix(es):

• nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections (CVE-2026-1642)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.

Security Fix(es):

• nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections (CVE-2026-1642)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.

Security Fix(es):

• nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections (CVE-2026-1642)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.

Security Fix(es):

• nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections (CVE-2026-1642)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.

Security Fix(es):

• nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections (CVE-2026-1642)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response from an upstream proxied server.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response from an upstream proxied server.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response from an upstream proxied server. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response from an upstream proxied server.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

• CVE-2026-1642: fix upstream TLS proxy vulnerability allowing MITM inject plaintext into proxied responses; enforce strict upstream TLS verification and reject injected plaintext

• CVE-2026-1642: fix upstream TLS MITM ability to inject plaintext into proxied responses; enforce stricter TLS verification and integrity checks

• SECURITY UPDATE: detect premature plain text response from SSL upstream (TLS plaintext injection)
  • debian/patches/CVE-2026-1642.patch: detect premature plain text response from SSL upstream (TLS plaintext injection)
  • CVE-2026-1642
• SECURITY UPDATE: fix NULL pointer dereference clearing s->passwd in mail auth http requests
  • debian/patches/CVE-2026-27651.patch: fix NULL pointer dereference clearing s->passwd in mail auth http requests
  • CVE-2026-27651
• SECURITY UPDATE: destination length validation for WebDAV COPY and MOVE (heap buffer overflow)
  • debian/patches/CVE-2026-27654.patch: destination length validation for WebDAV COPY and MOVE (heap buffer overflow)
  • CVE-2026-27654
• SECURITY UPDATE: fix integer overflow on 32-bit platforms in ngx_http_mp4_module
  • debian/patches/CVE-2026-27784.patch: fix integer overflow on 32-bit platforms in ngx_http_mp4_module
  • CVE-2026-27784
• SECURITY UPDATE: avoid zero size buffers in ngx_http_mp4_module output (out-of-bounds access)
  • debian/patches/CVE-2026-32647.patch: avoid zero size buffers in ngx_http_mp4_module output (out-of-bounds access)
  • CVE-2026-32647
• SECURITY UPDATE: reject unsafe characters in URIs and headers set via the Lua API (HTTP response splitting)
  • debian/modules/nginx-lua/src/ngx_http_lua_util.c, debian/modules/nginx-lua/src/ngx_http_lua_util.h, debian/modules/nginx-lua/src/ngx_http_lua_uri.c, debian/modules/nginx-lua/src/ngx_http_lua_headers_in.c, debian/modules/nginx-lua/src/ngx_http_lua_headers_out.c, debian/modules/nginx-lua/src/ngx_http_lua_control.c: validate arguments of the Lua APIs that mutate a URI or a request/response header so control characters raise an error instead of being silently truncated.
  • CVE-2020-36309

• SECURITY UPDATE: detect premature plain text response from SSL upstream (TLS plaintext injection)
  • debian/patches/CVE-2026-1642.patch: detect premature plain text response from SSL upstream (TLS plaintext injection)
  • CVE-2026-1642
• SECURITY UPDATE: fix NULL pointer dereference clearing s->passwd in mail auth http requests
  • debian/patches/CVE-2026-27651.patch: fix NULL pointer dereference clearing s->passwd in mail auth http requests
  • CVE-2026-27651
• SECURITY UPDATE: destination length validation for WebDAV COPY and MOVE (heap buffer overflow)
  • debian/patches/CVE-2026-27654.patch: destination length validation for WebDAV COPY and MOVE (heap buffer overflow)
  • CVE-2026-27654
• SECURITY UPDATE: fix integer overflow on 32-bit platforms in ngx_http_mp4_module
  • debian/patches/CVE-2026-27784.patch: fix integer overflow on 32-bit platforms in ngx_http_mp4_module
  • CVE-2026-27784
• SECURITY UPDATE: avoid zero size buffers in ngx_http_mp4_module output (out-of-bounds access)
  • debian/patches/CVE-2026-32647.patch: avoid zero size buffers in ngx_http_mp4_module output (out-of-bounds access)
  • CVE-2026-32647

• CVE-2026-1642: detect premature plain text response from SSL backend

• CVE-2026-1642: detect premature plain text response from SSL backend

• CVE-2026-1642: detect premature plain text response from SSL backend

• CVE-2026-1642: reject a plain text response read from an SSL-enabled upstream before the TLS handshake has started, preventing data injection by a man-in-the-middle on the upstream connection

• CVE-2026-1642: reject a plain text response read from an SSL-enabled upstream before the TLS handshake has started, preventing data injection by a man-in-the-middle on the upstream connection

• CVE-2026-1642: reject a plain text response read from an SSL-enabled upstream before the TLS handshake has started, preventing data injection by a man-in-the-middle on the upstream connection

• CVE-2026-1642: detect premature plain text response from SSL backend

• SECURITY UPDATE: plain text response injection via a premature response from an SSL-proxied upstream
  • debian/patches/CVE-2026-1642.patch: reject a response received in ngx_http_upstream_process_header before the upstream SSL handshake has started (u->ssl set, c->ssl still NULL) and retry the next upstream, so a man-in-the-middle on the proxy-to-upstream path can no longer have plain text data parsed as the upstream response
  • CVE-2026-1642

• CVE-2026-1642: detect premature plain text response from SSL backend

MitM injection. (CVE-2026-1642)

These are all security issues fixed in the nginx-1.29.5-1.1 package on the GA media of openSUSE Tumbleweed.

This update for nginx fixes the following issues:

• CVE-2026-1642: plain text data injection into the response from an upstream proxied server (bsc#1257675).
• CVE-2026-27654: buffer overflow in the NGINX worker process via the ngx_http_dav_module module (bsc#1260416).
• CVE-2026-27784: NGINX worker memory over-read or over-write via a specially crafted MP4 file (bsc#1260417).
• CVE-2026-28753: improper handling onf CRLF sequences in CRLF responses allows for arbitrary header injection into SMTP upstream requests (bsc#1260418).
• CVE-2026-28755: TLS handshakes can succeed with revoked certificates due to improper handling of such certificates by the ngx_stream_ssl_module module (bsc#1260419).