{"id":"CVE-2026-42934","aliases":["ALPINE-CVE-2026-42934","AZL-86853","BELL-CVE-2026-42934","BIT-nginx-2026-42934","BIT-nginx-gateway-2026-42934","CLSA-2026-1785509707","CLSA-2026-1785922957","DEBIAN-CVE-2026-42934","EUVD-2026-30008","GHSA-6vmc-2wh4-77qp","MGASA-2026-0156","OESA-2026-2510","OESA-2026-2511","OESA-2026-2512","OESA-2026-2513","OESA-2026-2514","SUSE-SU-2026:2050-1","SUSE-SU-2026:21832-1","SUSE-SU-2026:2370-1","UBUNTU-CVE-2026-42934","openSUSE-SU-2026:10796-1","openSUSE-SU-2026:20796-1"],"status":"published","title":"NGINX ngx_http_charset_module vulnerability","description":"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map and proxy_pass with disabled buffering (\"off\") directives are configured, unauthenticated attackers can send requests that with conditions beyond the attackers' control to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart.\n\n\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","severity":{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00731,"percentile":0.54563,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2026-05-13T14:12:44Z","modified":"2026-10-28T02:30:42Z","fixes":[{"ecosystem":"Alpine:v3.21","package":"nginx","fixed_in":["1.26.3-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"nginx","fixed_in":["1.28.3-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"nginx","fixed_in":["1.28.3-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"nginx","fixed_in":["1.30.1-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"nginx","fixed_in":["1.28.3-4"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"nginx","fixed_in":["1.22.1-r5"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"nginx","fixed_in":["1.28.3-r2"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"nginx","fixed_in":["1.30.1-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"nginx","fixed_in":["1.30.1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"nginx-gateway","fixed_in":["1.30.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"nginx","fixed_in":["1.22.1-9+deb12u7"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nginx","fixed_in":["1.26.3-3+deb13u5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nginx","fixed_in":["1.30.0-4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"nginx","fixed_in":["1.4.6-1ubuntu3.9+esm6"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nginx","fixed_in":["1.10.3-0ubuntu0.16.04.5+esm7"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nginx","fixed_in":["1.14.0-0ubuntu1.11+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"nginx","fixed_in":["1.18.0-0ubuntu1.7+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"nginx","fixed_in":["1.18.0-6ubuntu14.12"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"nginx","fixed_in":["1.24.0-2ubuntu7.9"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"nginx","fixed_in":["1.28.0-6ubuntu1.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"nginx","fixed_in":["1.28.3-2ubuntu1.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.21","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.3-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.3-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.3-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.1-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.3-4"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.22.1-r0"},{"fixed":"1.22.1-r5"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.28.0-r3"},{"fixed":"1.28.3-r2"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.22.1-r0"},{"fixed":"1.30.1-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"nginx","ranges":[{"type":"SEMVER","events":[{"introduced":"0.3.50"},{"fixed":"1.30.1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"nginx-gateway","ranges":[{"type":"SEMVER","events":[{"introduced":"0.3.50"},{"fixed":"1.30.1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.1-22.el9_6.3.alma.2.tuxcare.els9"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-all-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.1-22.el9_6.3.alma.2.tuxcare.els9"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.1-22.el9_6.3.alma.2.tuxcare.els9"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.1-22.el9_6.3.alma.2.tuxcare.els9"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-mod-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.1-22.el9_6.3.alma.2.tuxcare.els9"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-mod-http-image-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.1-22.el9_6.3.alma.2.tuxcare.els9"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-mod-http-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.1-22.el9_6.3.alma.2.tuxcare.els9"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-mod-http-xslt-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.1-22.el9_6.3.alma.2.tuxcare.els9"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-mod-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.1-22.el9_6.3.alma.2.tuxcare.els9"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-mod-stream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.1-22.el9_6.3.alma.2.tuxcare.els9"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-14.el9_2.1.alma.1.tuxcare.els13"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-all-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-14.el9_2.1.alma.1.tuxcare.els13"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-14.el9_2.1.alma.1.tuxcare.els13"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-14.el9_2.1.alma.1.tuxcare.els13"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-mod-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-14.el9_2.1.alma.1.tuxcare.els13"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-mod-http-image-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-14.el9_2.1.alma.1.tuxcare.els13"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-mod-http-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-14.el9_2.1.alma.1.tuxcare.els13"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-mod-http-xslt-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-14.el9_2.1.alma.1.tuxcare.els13"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-mod-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-14.el9_2.1.alma.1.tuxcare.els13"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-mod-stream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-14.el9_2.1.alma.1.tuxcare.els13"}]}],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.1-9+deb12u7"}]}],"versions":["1.22.1-9","1.22.1-9+deb12u1","1.22.1-9+deb12u2","1.22.1-9+deb12u3","1.22.1-9+deb12u4","1.22.1-9+deb12u5","1.22.1-9+deb12u6"]},{"source":"osv","ecosystem":"Debian:13","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.3-3+deb13u5"}]}],"versions":["1.26.3-3","1.26.3-3+deb13u1","1.26.3-3+deb13u2","1.26.3-3+deb13u3","1.26.3-3+deb13u4"]},{"source":"osv","ecosystem":"Debian:14","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.0-4"}]}],"versions":["1.26.3-3","1.28.0-1","1.28.0-2","1.28.0-3","1.28.0-4","1.28.0-5","1.28.0-6","1.28.1-1","1.28.1-2","1.28.1-3","1.28.2-1","1.28.2-2","1.28.2-3","1.28.2-4","1.28.3-1","1.28.3-2","1.30.0-1","1.30.0-2","1.30.0-3"]},{"source":"osv","ecosystem":"Mageia:9","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.1-1.mga9"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-10.oe2403sp1"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-10.oe2403sp3"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.5-12.oe2003sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.5-14.oe2203sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-10.oe2403"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.5-150400.3.20.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.5-150400.3.20.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.5-150400.3.20.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.5-150400.3.20.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.5-150400.3.20.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.5-150400.3.20.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.5-150400.3.20.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.5-150400.3.20.1"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-1ubuntu3.9+esm6"}]}],"versions":["1.4.1-3ubuntu1","1.4.3-2ubuntu1","1.4.4-1ubuntu1","1.4.4-2ubuntu1","1.4.4-4ubuntu1","1.4.5-1ubuntu1","1.4.6-1ubuntu2","1.4.6-1ubuntu3","1.4.6-1ubuntu3.1","1.4.6-1ubuntu3.2","1.4.6-1ubuntu3.3","1.4.6-1ubuntu3.4","1.4.6-1ubuntu3.5","1.4.6-1ubuntu3.6","1.4.6-1ubuntu3.7","1.4.6-1ubuntu3.8","1.4.6-1ubuntu3.9","1.4.6-1ubuntu3.9+esm1","1.4.6-1ubuntu3.9+esm2","1.4.6-1ubuntu3.9+esm3","1.4.6-1ubuntu3.9+esm4","1.4.6-1ubuntu3.9+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-0ubuntu0.16.04.5+esm7"}]}],"versions":["1.9.3-1ubuntu1","1.9.6-2ubuntu1","1.9.6-2ubuntu2","1.9.9-0ubuntu1","1.9.9-1ubuntu1","1.9.10-0ubuntu1","1.9.10-1ubuntu1","1.9.11-0ubuntu1","1.9.11-0ubuntu2","1.9.12-0ubuntu1","1.9.13-0ubuntu1","1.9.14-0ubuntu1","1.9.15-0ubuntu1","1.10.0-0ubuntu0.16.04.1","1.10.0-0ubuntu0.16.04.2","1.10.0-0ubuntu0.16.04.3","1.10.0-0ubuntu0.16.04.4","1.10.3-0ubuntu0.16.04.1","1.10.3-0ubuntu0.16.04.2","1.10.3-0ubuntu0.16.04.3","1.10.3-0ubuntu0.16.04.4","1.10.3-0ubuntu0.16.04.5","1.10.3-0ubuntu0.16.04.5+esm1","1.10.3-0ubuntu0.16.04.5+esm2","1.10.3-0ubuntu0.16.04.5+esm3","1.10.3-0ubuntu0.16.04.5+esm4","1.10.3-0ubuntu0.16.04.5+esm5","1.10.3-0ubuntu0.16.04.5+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-0ubuntu1.11+esm2"}]}],"versions":["1.12.1-0ubuntu2","1.13.6-2ubuntu1","1.13.6-2ubuntu2","1.13.10-1ubuntu1","1.13.12-0ubuntu1","1.14.0-0ubuntu1","1.14.0-0ubuntu1.1","1.14.0-0ubuntu1.2","1.14.0-0ubuntu1.3","1.14.0-0ubuntu1.4","1.14.0-0ubuntu1.5","1.14.0-0ubuntu1.6","1.14.0-0ubuntu1.7","1.14.0-0ubuntu1.9","1.14.0-0ubuntu1.10","1.14.0-0ubuntu1.11","1.14.0-0ubuntu1.11+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-0ubuntu1.7+esm1"}]}],"versions":["1.16.1-0ubuntu2","1.16.1-0ubuntu3","1.17.5-0ubuntu1","1.17.6-0ubuntu1","1.17.7-0ubuntu1","1.17.8-0ubuntu1","1.17.8-0ubuntu2","1.17.8-0ubuntu3","1.17.9-0ubuntu1","1.17.9-0ubuntu2","1.17.9-0ubuntu3","1.17.10-0ubuntu1","1.18.0-0ubuntu1","1.18.0-0ubuntu1.2","1.18.0-0ubuntu1.3","1.18.0-0ubuntu1.4","1.18.0-0ubuntu1.5","1.18.0-0ubuntu1.6","1.18.0-0ubuntu1.7"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-6ubuntu14.12"}]}],"versions":["1.18.0-6ubuntu11","1.18.0-6ubuntu12","1.18.0-6ubuntu14","1.18.0-6ubuntu14.1","1.18.0-6ubuntu14.2","1.18.0-6ubuntu14.3","1.18.0-6ubuntu14.4","1.18.0-6ubuntu14.5","1.18.0-6ubuntu14.6","1.18.0-6ubuntu14.7","1.18.0-6ubuntu14.8","1.18.0-6ubuntu14.10","1.18.0-6ubuntu14.11"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-2ubuntu7.9"}]}],"versions":["1.24.0-1ubuntu1","1.24.0-2ubuntu1","1.24.0-2ubuntu2","1.24.0-2ubuntu3","1.24.0-2ubuntu4","1.24.0-2ubuntu6","1.24.0-2ubuntu7","1.24.0-2ubuntu7.1","1.24.0-2ubuntu7.3","1.24.0-2ubuntu7.4","1.24.0-2ubuntu7.5","1.24.0-2ubuntu7.6","1.24.0-2ubuntu7.7","1.24.0-2ubuntu7.8"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.0-6ubuntu1.4"}]}],"versions":["1.26.3-2ubuntu1","1.26.3-3ubuntu1","1.26.3-3ubuntu2","1.26.3-3ubuntu3","1.28.0-3ubuntu1","1.28.0-4ubuntu1","1.28.0-6ubuntu1","1.28.0-6ubuntu1.1","1.28.0-6ubuntu1.2","1.28.0-6ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.3-2ubuntu1.2"}]}],"versions":["1.28.0-6ubuntu1","1.28.1-2ubuntu1","1.28.1-3ubuntu1","1.28.2-2ubuntu1","1.28.3-2ubuntu1","1.28.3-2ubuntu1.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31.0-1.1"}]}],"bundled":6}],"products":[{"vendor":"f5","product":"dos"},{"vendor":"f5","product":"nginx open source"},{"vendor":"f5","product":"nginx plus"},{"vendor":"f5","product":"nginx_gateway_fabric"},{"vendor":"f5","product":"nginx_ingress_controller"},{"vendor":"f5","product":"nginx_instance_manager"},{"vendor":"f5","product":"nginx_open_source"},{"vendor":"f5","product":"nginx_plus"},{"vendor":"f5","product":"waf"}],"references":[{"url":"https://my.f5.com/manage/s/article/K000161028","tags":["vendor-advisory","patch","Mitigation","Vendor Advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42934","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-6vmc-2wh4-77qp"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-42934","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-42934","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1785509707.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53859","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28753","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40701","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42946","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48142","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1785922957.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-60005","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-42934","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0156.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35529","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/05/13/7","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2510","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42945","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2511","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2512","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2513","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2514","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262050-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1260415","tags":["report"]},{"url":"https://bugzilla.suse.com/1260420","tags":["report"]},{"url":"https://bugzilla.suse.com/1265229","tags":["report"]},{"url":"https://bugzilla.suse.com/1265231","tags":["report"]},{"url":"https://bugzilla.suse.com/1265232","tags":["report"]},{"url":"https://bugzilla.suse.com/1265233","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27651","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32647","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40701","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42946","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621832-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262370-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1266215","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9256","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-42934","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42934","tags":["report"]},{"url":"https://nginx.org/en/security_advisories.html","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8354-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8375-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40460","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42926","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-42934","title":"NGINX ngx_http_charset_module vulnerability","description":"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map and proxy_pass with disabled buffering (\"off\") directives are configured, unauthenticated attackers can send requests that with conditions beyond the attackers' control to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart.\n\n\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-05-13T14:12:44.331Z","modified":"2026-06-08T20:34:05.147Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T13:40:23.731501Z"}],"euvd":[{"id":"EUVD-2026-30008","description":"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map and proxy_pass with disabled buffering (\"off\") directives are configured, unauthenticated attackers can send requests that with conditions beyond the attackers' control to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart.\n\n\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-05-13T14:12:44Z","modified":"2026-06-08T20:34:05Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:20:48.375828Z"}],"ghsa":[{"id":"GHSA-6vmc-2wh4-77qp","title":"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When...","description":"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map and proxy_pass with disabled buffering (\"off\") directives are configured, unauthenticated attackers can send requests that with conditions beyond the attackers' control to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart.\n\n\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-05-13T18:30:56Z","modified":"2026-05-13T18:31:06Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:08:07.741271Z"}],"nvd":[{"id":"CVE-2026-42934","description":"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map and proxy_pass with disabled buffering (\"off\") directives are configured, unauthenticated attackers can send requests that with conditions beyond the attackers' control to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart.\n\n\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-05-13T16:16:49.91Z","modified":"2026-10-26T14:10:00.13Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:12:19.020465Z"}],"osv":[{"id":"ALPINE-CVE-2026-42934","description":"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map and proxy_pass with disabled buffering (\"off\") directives are configured, unauthenticated attackers can send requests that with conditions beyond the attackers' control to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart.\n\n\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-05-13T16:16:49.91Z","modified":"2026-10-01T02:17:49.298460673Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:27:50.764331Z"},{"id":"BELL-CVE-2026-42934","status":"published","published":"2026-05-15T14:24:29.626121Z","modified":"2026-05-20T07:15:05.29621808Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:28:23.844435Z"},{"id":"CVE-2026-42934","description":"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map and proxy_pass with disabled buffering (\"off\") directives are configured, unauthenticated attackers can send requests that with conditions beyond the attackers' control to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart.\n\n\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-05-13T16:16:49.91Z","modified":"2026-10-28T02:30:42.893954014Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:04.117819Z"},{"id":"DEBIAN-CVE-2026-42934","description":"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map and proxy_pass with disabled buffering (\"off\") directives are configured, unauthenticated attackers can send requests that with conditions beyond the attackers' control to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart.     Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-05-13T16:16:49.91Z","modified":"2026-10-27T09:47:32.370219987Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:55.251751Z"},{"id":"OESA-2026-2510","title":"nginx security update","description":"NGINX is a free, open-source, high-performance HTTP server and reverse proxy,  as well as an IMAP/POP3 proxy server.\r\n\r\nSecurity Fix(es):\n\nNGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the ssl_verify_client directive is set to \u0026quot;on\u0026quot; or \u0026quot;optional,\u0026quot; and the ssl_ocsp directive is set to \u0026quot;on\u0026quot; or the leaf parameters are configured with a resolver. With this configuration, an unauthenticated attacker can send requests along with conditions beyond its control that may cause a heap-use-after-free error in the NGINX worker process. This vulnerability may result in limited modification of data or the NGINX worker process restarting. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-40701)\n\nNGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map and proxy_pass with disabled buffering (\u0026quot;off\u0026quot;) directives are configured, unauthenticated attackers can send requests that with conditions beyond the attackers\u0026apos; control to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-42934)\n\nNGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, for systems with Address Space Layout Randomization (ASLR ) disabled, code execution is possible.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-42945)\n\nA vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data. When scgi_pass or uwsgi_pass is configured, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to read the memory of the NGINX worker process or restart it.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-42946)","status":"published","published":"2026-05-29T11:11:27Z","modified":"2026-08-18T01:20:01.483737845Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2511","title":"nginx security update","description":"NGINX is a free, open-source, high-performance HTTP server and reverse proxy,  as well as an IMAP/POP3 proxy server.\r\n\r\nSecurity Fix(es):\n\nNGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the ssl_verify_client directive is set to \u0026quot;on\u0026quot; or \u0026quot;optional,\u0026quot; and the ssl_ocsp directive is set to \u0026quot;on\u0026quot; or the leaf parameters are configured with a resolver. With this configuration, an unauthenticated attacker can send requests along with conditions beyond its control that may cause a heap-use-after-free error in the NGINX worker process. This vulnerability may result in limited modification of data or the NGINX worker process restarting. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-40701)\n\nNGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map and proxy_pass with disabled buffering (\u0026quot;off\u0026quot;) directives are configured, unauthenticated attackers can send requests that with conditions beyond the attackers\u0026apos; control to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-42934)\n\nA vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data. When scgi_pass or uwsgi_pass is configured, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to read the memory of the NGINX worker process or restart it.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-42946)","status":"published","published":"2026-05-29T11:11:27Z","modified":"2026-08-18T01:20:01.447678877Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2512","title":"nginx security update","description":"NGINX is a free, open-source, high-performance HTTP server and reverse proxy,  as well as an IMAP/POP3 proxy server.\r\n\r\nSecurity Fix(es):\n\nNGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the ssl_verify_client directive is set to \u0026quot;on\u0026quot; or \u0026quot;optional,\u0026quot; and the ssl_ocsp directive is set to \u0026quot;on\u0026quot; or the leaf parameters are configured with a resolver. With this configuration, an unauthenticated attacker can send requests along with conditions beyond its control that may cause a heap-use-after-free error in the NGINX worker process. This vulnerability may result in limited modification of data or the NGINX worker process restarting. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-40701)\n\nNGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map and proxy_pass with disabled buffering (\u0026quot;off\u0026quot;) directives are configured, unauthenticated attackers can send requests that with conditions beyond the attackers\u0026apos; control to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-42934)\n\nA vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data. When scgi_pass or uwsgi_pass is configured, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to read the memory of the NGINX worker process or restart it.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-42946)","status":"published","published":"2026-05-29T11:11:27Z","modified":"2026-08-18T01:20:01.487237782Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2513","title":"nginx security update","description":"NGINX is a free, open-source, high-performance HTTP server and reverse proxy,  as well as an IMAP/POP3 proxy server.\r\n\r\nSecurity Fix(es):\n\nNGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the ssl_verify_client directive is set to \u0026quot;on\u0026quot; or \u0026quot;optional,\u0026quot; and the ssl_ocsp directive is set to \u0026quot;on\u0026quot; or the leaf parameters are configured with a resolver. With this configuration, an unauthenticated attacker can send requests along with conditions beyond its control that may cause a heap-use-after-free error in the NGINX worker process. This vulnerability may result in limited modification of data or the NGINX worker process restarting. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-40701)\n\nNGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map and proxy_pass with disabled buffering (\u0026quot;off\u0026quot;) directives are configured, unauthenticated attackers can send requests that with conditions beyond the attackers\u0026apos; control to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-42934)\n\nA vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data. When scgi_pass or uwsgi_pass is configured, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to read the memory of the NGINX worker process or restart it.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-42946)","status":"published","published":"2026-05-29T11:11:27Z","modified":"2026-08-18T01:20:01.945488386Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2514","title":"nginx security update","description":"NGINX is a free, open-source, high-performance HTTP server and reverse proxy,  as well as an IMAP/POP3 proxy server.\r\n\r\nSecurity Fix(es):\n\nNGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the ssl_verify_client directive is set to \u0026quot;on\u0026quot; or \u0026quot;optional,\u0026quot; and the ssl_ocsp directive is set to \u0026quot;on\u0026quot; or the leaf parameters are configured with a resolver. With this configuration, an unauthenticated attacker can send requests along with conditions beyond its control that may cause a heap-use-after-free error in the NGINX worker process. This vulnerability may result in limited modification of data or the NGINX worker process restarting. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-40701)\n\nNGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map and proxy_pass with disabled buffering (\u0026quot;off\u0026quot;) directives are configured, unauthenticated attackers can send requests that with conditions beyond the attackers\u0026apos; control to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-42934)\n\nA vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data. When scgi_pass or uwsgi_pass is configured, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to read the memory of the NGINX worker process or restart it.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-42946)","status":"published","published":"2026-05-29T11:11:27Z","modified":"2026-08-18T01:20:01.994421817Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"UBUNTU-CVE-2026-42934","description":"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map and proxy_pass with disabled buffering (\"off\") directives are configured, unauthenticated attackers can send requests that with conditions beyond the attackers' control to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-05-13T16:16:00Z","modified":"2026-06-03T17:59:17.606206874Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"},{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:56:18.393417Z"},{"id":"AZL-86853","title":"CVE-2026-42934 affecting package nginx for versions less than 1.28.3-4","description":"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map and proxy_pass with disabled buffering (\"off\") directives are configured, unauthenticated attackers can send requests that with conditions beyond the attackers' control to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart.\n\n\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-05-13T16:16:49Z","modified":"2026-09-22T05:34:53Z","updated_at":"2026-11-02T15:28:10.677811Z"},{"id":"BIT-nginx-2026-42934","title":"NGINX ngx_http_charset_module vulnerability","description":"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map and proxy_pass with disabled buffering (\"off\") directives are configured, unauthenticated attackers can send requests that with conditions beyond the attackers' control to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart.\n\n\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-05-15T08:50:06.374Z","modified":"2026-09-08T08:48:16.79930381Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"BIT-nginx-gateway-2026-42934","title":"NGINX ngx_http_charset_module vulnerability","description":"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map and proxy_pass with disabled buffering (\"off\") directives are configured, unauthenticated attackers can send requests that with conditions beyond the attackers' control to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart.\n\n\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-05-15T08:50:09.022Z","modified":"2026-09-08T08:48:16.848097001Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"CLSA-2026-1785509707","title":"nginx: Fix of 6 CVEs","description":"- CVE-2025-53859: fix buffer over-read in the SMTP authentication path that\n  could disclose worker process memory to the authentication server\n- CVE-2026-28753: validate host names resolved from the client address to\n  prevent header injection into auth_http and XCLIENT requests\n- CVE-2026-40701: fix use-after-free by cancelling a pending OCSP responder\n  resolve when the client connection is closed\n- CVE-2026-42934: fix buffer over-read in the charset filter when a UTF-8\n  sequence is split across several buffers\n- CVE-2026-48142: fix remaining buffer over-read in the charset filter on\n  invalid UTF-8 sequences\n- CVE-2026-42946: reset the parsing state and restore the buffer position\n  after an unrecognized upstream status line in the scgi and uwsgi modules","status":"published","published":"2026-07-31T15:01:40Z","modified":"2026-10-26T09:43:18.215783126Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1785922957","title":"nginx: Fix of 5 CVEs","description":"- CVE-2026-40701: fix resolver use-after-free in OCSP; the resolve\n  context was leaked when a client SSL connection was terminated while\n  resolving an OCSP responder, so completion of the resolve touched\n  freed memory\n- CVE-2025-53859: fix buffer over-read in ngx_mail_smtp_module; login\n  and password storage could be left in an inconsistent state after\n  base64 decoding errors in the plain/login/cram-md5 auth methods\n- CVE-2026-28753: validate the host name resolved from the client\n  address against the character set of RFC 1034 section 3.5,\n  preventing CRLF injection into auth_http and smtp proxy requests\n- CVE-2026-42934: fix buffer over-read in ngx_http_charset_module\n  recode_from_utf8(); pass the saved byte count rather than the last\n  saved index to ngx_utf8_decode() and advance past the whole saved\n  sequence on invalid UTF-8","status":"published","published":"2026-08-26T15:39:23Z","modified":"2026-10-26T09:43:34.844504309Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"MGASA-2026-0156","title":"Updated nginx packages fix security vulnerabilities","description":"NGINX ngx_quic_module vulnerability. (CVE-2026-40460)\nNGINX ngx_http_ssl_module vulnerability. (CVE-2026-40701)\nNGINX ngx_http_proxy_v2_module vulnerability. (CVE-2026-42926)\nNGINX ngx_http_charset_module vulnerability. (CVE-2026-42934)\nNGINX ngx_http_rewrite_module vulnerability. (CVE-2026-42945)\nNGINX ngx_http_scgi_module and ngx_http_uwsgi_module vulnerability.\n(CVE-2026-42946)\n","status":"published","published":"2026-05-26T01:55:28Z","modified":"2026-05-26T02:00:04.269313969Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:10796-1","title":"nginx-1.31.0-1.1 on GA media","description":"These are all security issues fixed in the nginx-1.31.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-16T00:00:00Z","modified":"2026-05-17T14:18:07.625976Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20796-1","title":"Security update for nginx","description":"This update for nginx fixes the following issues\n\n- CVE-2026-27651: denial of service via undisclosed requests when the `ngx_mail_auth_http_module` is enabled\n  (bsc#1260415).\n- CVE-2026-32647: NGINX worker memory over-read or over-write via a specially crafted MP4 file (bsc#1260420).\n- CVE-2026-40701: heap use-after-free in the worker process when the `ssl_verify_client` and the `ssl_ocsp` directives\n  are set due to issue in the `ngx_http_ssl_module` module (bsc#1265229).\n- CVE-2026-42934: heap buffer overread in the worker process due to issue in the `ngx_http_charset_module` module\n  (bsc#1265231).\n- CVE-2026-42945: heap buffer overflow via crafted HTTP requests due to issue in `ngx_http_rewrite_module`\n  (bsc#1265232).\n- CVE-2026-42946: excessive memory allocation and data overread due to issue in the `ngx_http_scgi_module` and\n  `ngx_http_uwsgi_module` modules (bsc#1265233).\n","status":"published","published":"2026-05-25T07:42:01Z","modified":"2026-05-28T18:24:16.31759646Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:2050-1","title":"Security update for nginx","description":"This update for nginx fixes the following issues\n\n- CVE-2026-27651: denial of service via undisclosed requests when the `ngx_mail_auth_http_module` is enabled\n  (bsc#1260415).\n- CVE-2026-32647: NGINX worker memory over-read or over-write via a specially crafted MP4 file (bsc#1260420).\n- CVE-2026-40701: heap use-after-free in the worker process when the `ssl_verify_client` and the `ssl_ocsp` directives\n  are set due to issue in the `ngx_http_ssl_module` module (bsc#1265229).\n- CVE-2026-42934: heap buffer overread in the worker process due to issue in the `ngx_http_charset_module` module\n  (bsc#1265231).\n- CVE-2026-42945: heap buffer overflow via crafted HTTP requests due to issue in `ngx_http_rewrite_module`\n  (bsc#1265232).\n- CVE-2026-42946: excessive memory allocation and data overread due to issue in the `ngx_http_scgi_module` and\n  `ngx_http_uwsgi_module` modules (bsc#1265233).\n","status":"published","published":"2026-05-25T13:58:44Z","modified":"2026-05-26T08:15:06.667308404Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:21832-1","title":"Security update for nginx","description":"This update for nginx fixes the following issues\n\n- CVE-2026-27651: denial of service via undisclosed requests when the `ngx_mail_auth_http_module` is enabled\n  (bsc#1260415).\n- CVE-2026-32647: NGINX worker memory over-read or over-write via a specially crafted MP4 file (bsc#1260420).\n- CVE-2026-40701: heap use-after-free in the worker process when the `ssl_verify_client` and the `ssl_ocsp` directives\n  are set due to issue in the `ngx_http_ssl_module` module (bsc#1265229).\n- CVE-2026-42934: heap buffer overread in the worker process due to issue in the `ngx_http_charset_module` module\n  (bsc#1265231).\n- CVE-2026-42945: heap buffer overflow via crafted HTTP requests due to issue in `ngx_http_rewrite_module`\n  (bsc#1265232).\n- CVE-2026-42946: excessive memory allocation and data overread due to issue in the `ngx_http_scgi_module` and\n  `ngx_http_uwsgi_module` modules (bsc#1265233).\n","status":"published","published":"2026-05-25T07:47:08Z","modified":"2026-05-28T18:24:13.448508818Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:2370-1","title":"Security update for nginx","description":"This update for nginx fixes the following issues\n\n- CVE-2026-9256: heap buffer overflow in the `ngx_http_rewrite_module` when using a configuration with overlapping\n  captures (bsc#1266215).\n- CVE-2026-27651: denial of service via undisclosed requests when the `ngx_mail_auth_http_module` is enabled\n  (bsc#1260415).\n- CVE-2026-32647: NGINX worker memory over-read or over-write via a specially crafted MP4 file (bsc#1260420).\n- CVE-2026-40701: heap use-after-free in the worker process when the `ssl_verify_client` and the `ssl_ocsp` directives\n  are set due to issue in the `ngx_http_ssl_module` module (bsc#1265229).\n- CVE-2026-42934: heap buffer overread in the worker process due to issue in the `ngx_http_charset_module` module\n  (bsc#1265231).\n- CVE-2026-42945: heap buffer overflow via crafted HTTP requests due to issue in `ngx_http_rewrite_module`\n  (bsc#1265232).\n- CVE-2026-42946: excessive memory allocation and data overread due to issue in the `ngx_http_scgi_module` and\n  `ngx_http_uwsgi_module` modules (bsc#1265233).\n","status":"published","published":"2026-06-11T13:23:38Z","modified":"2026-06-12T08:45:05.877106734Z","updated_at":"2026-11-02T15:54:03.991985Z"}]}}