CVE-2026-48142: 
NGINX vulnerability analysis and mitigation

CVE-2026-48142 is a heap buffer over-read vulnerability in the ngx_http_charset_module of NGINX Plus and NGINX Open Source. When a location block is configured with both source_charset utf-8; and a charset directive (e.g., charset koi8-r;), remote unauthenticated attackers can send crafted requests to trigger limited memory disclosure or a worker process restart. The vulnerability was disclosed on June 17, 2026. Affected versions include NGINX Open Source 1.13.10 through 1.30.2 and 1.31.0–1.31.1, and NGINX Plus R33–R36 and 37.0–37.0.1. It carries a CVSS v3.1 base score of 4.8 (Medium) and a CVSS v4.0 base score of 6.3 (Medium) (GitHub Advisory, F5 Advisory).

The vulnerability is classified as CWE-125 (Out-of-bounds Read) and resides in NGINX's ngx_http_charset_module, which handles character encoding conversion between charsets (GitHub Advisory, Red Hat Bugzilla). When a location block simultaneously specifies source_charset utf-8; and a target charset directive (e.g., charset koi8-r;), improper bounds checking during the encoding conversion process allows the worker process to read beyond the intended heap buffer. Exploitation requires the attacker to send specially crafted HTTP requests, but also depends on conditions beyond the attacker's direct control (e.g., specific content being served or proxied), making the attack complexity high. No public proof-of-concept code has been reported (GitHub Advisory).

Successful exploitation can result in limited disclosure of heap memory contents from the NGINX worker process, potentially exposing sensitive in-memory data such as request headers, cached content, or internal state. Additionally, the over-read can cause the NGINX worker process to crash and restart, resulting in a temporary denial of service for active connections. The scope is limited to the vulnerable system itself, with no integrity impact and no evidence of lateral movement potential (GitHub Advisory, Red Hat Bugzilla).

• Logs: Unexpected NGINX worker process restarts logged in /var/log/nginx/error.log (e.g., worker process exited on signal 11 or similar crash signals); unusual or malformed HTTP requests targeting endpoints served by location blocks with dual charset configuration.
• Process: Repeated NGINX worker process respawns visible via systemctl status nginx or process monitoring tools, potentially indicating repeated crash-and-restart cycles triggered by crafted requests.
• Network: High volume of HTTP requests from a single source IP targeting charset-conversion-enabled endpoints; anomalous request patterns with unusual Accept-Charset or content-type headers.

F5 has released patched versions: NGINX Open Source 1.31.2 and 1.30.3, and NGINX Plus R36 P6 and 37.0.2.1 (F5 Advisory). As a temporary workaround, administrators should audit all location blocks and remove dual charset configurations (i.e., avoid simultaneously using source_charset utf-8; and a charset directive in the same block) where not strictly required. If the ngx_http_charset_module is not needed for production use, it can be disabled at compile time or by removing the module. Restricting access to affected endpoints to trusted sources via firewall rules or NGINX allow/deny directives can also reduce exposure (GitHub Advisory).

Security news outlets including CyberSecurityNews and CyberPress covered the vulnerability shortly after disclosure, with some headlines characterizing the broader NGINX patch release as addressing critical flaws (cybersecuritynews.com). A Mastodon post on infosec.exchange noted the advisory. FreeBSD and Fedora package maintainers moved quickly to update their nginx packages, with commits appearing within days of the disclosure. Red Hat opened a Bugzilla tracking entry and is evaluating impact on RHEL (Red Hat Bugzilla). Ubuntu also issued a security advisory for nginx addressing this CVE.