Home

Description

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map and proxy_pass with disabled buffering ("off") directives are configured, unauthenticated attackers can send requests that with conditions beyond the attackers' control to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

PUBLISHED Reserved 2026-04-30 | Published 2026-05-13 | Updated 2026-06-08 | Assigner f5




MEDIUM: 4.8CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

MEDIUM: 6.3CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

Problem types

CWE-125 Out-of-bounds Read

Product status

Default status
unknown

R37 (custom) before *
unaffected

R36 (custom) before R36 P4
affected

R32 (custom) before R32 P6
affected

Default status
unaffected

1.31.0 (semver) before *
unaffected

0.3.50 (semver) before 1.30.1
affected

Credits

F5 acknowledges David Carlier, Zhenpeng (Leo) Lin of depthfirst, and GAO Liyou for bringing this issue to our attention and following the highest standards of coordinated disclosure. finder

References

my.f5.com/manage/s/article/K000161028 vendor-advisory patch

cve.org (CVE-2026-42934)

nvd.nist.gov (CVE-2026-42934)

Download JSON