CVE-2026-1642

Description

A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response from an upstream proxied server.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

How to fix CVE-2026-1642

To remediate CVE-2026-1642, upgrade the affected package to a fixed version below.

• Alpine/nginx—upgrade to 1.28.2-r0 or later
• —upgrade to 1.28.4 or later
• —upgrade to 1.29.5 or later
• —upgrade to 1.18.0-6.1+deb11u6 or later
• —upgrade to 1.22.1-9+deb12u4 or later

Is CVE-2026-1642 being exploited?

Low — EPSS is 0.3%, meaning exploitation activity has not been observed at scale.

Affected packages (5)

• from 0, < 1.28.2-r0
• >= 1.3.0, < 1.28.4, >= 1.29.4, < 1.29.5
• >= 1.3.0, < 1.29.5
• from 0, < 1.18.0-6.1+deb11u6
• from 0, < 1.22.1-9+deb12u4

CVSS scores

References (5)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2026-1642
• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2026-1642
• WEBwww.openwall.com/lists/oss-security/2026/02/05/1
• WEBmy.f5.com/manage/s/article/K000159824
• WEB