medium5.9
CVE-2026-1642
A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers.
Impact
A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response from an upstream proxied server. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| F5 | Nginx Gateway Fabric | from 1.2.0 through 1.6.2 from 2.0.0 before 2.4.1 |
| F5 | Nginx Ingress Controller | from 3.4.0 through 3.7.2 from 4.0.0 through 4.0.1 from 5.0.0 before 5.3.3 |
| F5 | Nginx Instance Manager | from 2.15.1 through 2.21.0 |
| F5 | Nginx Open Source | from 1.3.0 before 1.28.2 from 1.29.0 before 1.29.5 |
| F5 | Nginx Plus | from r33 before r35 Versions r32, r33, r34, r35, r36 |