CVE-2026-1642: 
NGINX vulnerability analysis and mitigation

CVE-2026-1642 is a man-in-the-middle (MITM) data injection vulnerability in NGINX OSS and NGINX Plus when configured to proxy to upstream TLS servers. An attacker with a MITM position on the upstream server side—along with conditions beyond the attacker's control—may inject plain text data into the response from an upstream proxied server. The vulnerability was disclosed on February 4, 2026, and affects NGINX Open Source versions 1.3.0 through 1.29.4, NGINX Plus R32 through R36 (various patch levels), NGINX Ingress Controller, NGINX Gateway Fabric, NGINX Instance Manager, and IBM Cloud Pak for AIOps. It carries a CVSS v3.1 base score of 5.9 (Medium) and a CVSS v4.0 base score of 8.2 (High) (F5 Advisory, oss-security).

The vulnerability is classified under CWE-349 (Acceptance of Extraneous Untrusted Data With Trusted Data) and CWE-345 (Insufficient Verification of Data Authenticity). When NGINX is configured to proxy requests to upstream TLS-enabled backends (HTTP 1.x, HTTP/2, gRPC, and uWSGI), it fails to sufficiently verify the authenticity of data received from those upstream connections, allowing a network-positioned attacker to inject plain text content into proxied responses. Exploitation requires the attacker to hold a MITM position specifically on the upstream (server-side) network path between NGINX and the backend, along with additional conditions outside the attacker's direct control. The code fix was introduced in the NGINX GitHub repository (oss-security, F5 Advisory).

Successful exploitation allows an unauthenticated attacker with upstream MITM positioning to inject arbitrary plain text data into responses served to downstream clients, resulting in a high integrity impact. Confidentiality and availability are not directly affected. The practical consequences include response tampering, content spoofing, and potential manipulation of application-layer data delivered to end users or downstream services relying on the proxied responses (F5 Advisory, oss-security).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report (Feedly). The EPSS score is approximately 0.012% (0.000120), reflecting a very low probability of near-term exploitation. Exploitation requires a privileged network position (upstream MITM) and additional uncontrolled conditions, significantly raising the bar for attackers. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The issue was discovered internally by F5 (F5 Advisory).

F5 has released fixed versions addressing this vulnerability. For NGINX Open Source, upgrade to 1.28.2 (stable branch) or 1.29.5 (mainline branch). For NGINX Plus, upgrade to R35 P1 or later (R32 requires P4+, R35 requires P1+, R36 requires P2+). For NGINX Ingress Controller, upgrade to 3.7.2+, 4.0.1+, or 5.3.3+. For NGINX Gateway Fabric, upgrade to 1.6.2+ or 2.4.1+. For NGINX Instance Manager, upgrade to 2.21.0 or later. No configuration-based workaround is available. Red Hat, Oracle, Debian, Ubuntu, SUSE, Amazon Linux, AlmaLinux, Rocky Linux, and IBM have all released downstream advisories and updated packages (F5 Advisory, Red Hat Bugzilla, Oracle CPU Apr 2026).

F5 disclosed the vulnerability via its customer portal and the issue was cross-posted to the oss-security mailing list by an independent researcher who noted that F5/NGINX does not typically post security announcements there (oss-security). Security news outlets including CyberSecurityNews, GBHackers, and Cybernoz covered the disclosure as part of broader F5 patch roundups addressing BIG-IP and NGINX vulnerabilities. Community discussion on Reddit's r/pwnhub noted the patches alongside Cisco fixes. The vulnerability received broad downstream attention given NGINX's widespread deployment, with rapid patch uptake across major Linux distributions.