8.2

CVE-2026-1642: f5 nginx gateway fabric

CVSS: 8.2v4.0HighAnalyzed
AliasesALPINE-CVE-2026-1642MGASA-2026-0033RHSA-2026:3638
Published 04-02-2026Last modified 05-02-2026
Open JSON

Vulnerability summary

CVE-2026-1642 is a high (CVSS 8.2) vulnerability in f5 nginx gateway fabric. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 31% of scored vulnerabilities.

Overall risk
33/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.2/10
010
High · v4.0 (CVE.org)
EPSS score
0.39%
0%100%
Low · +0.03 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 2
RHSA-2026:8346CGA-MPCG-76RF-HJP9USN-8375-1

Timeline

  1. 04-02-2026
    PublishedVulnerability first disclosed.
  2. 05-02-2026
    Last modifiedVulnerability information updated.

Description

A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response from an upstream proxied server.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS metrics

11 scores · 8 sources · 2 versions

EPSS trend

Probability

0.39%

Chance of exploitation in the next 30 days

Percentile

31%

Versus all other CVEs

30-day change

+0.03 pp

From 0.35% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.39%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard18 products
  • nginx-mainline< 1.29.5-r0
  • nginx-stable< 1.28.2-r0
  • nginx-stable-config< 1.28.2-r0
  • nginx-stable-config-compat< 1.28.2-r0
  • nginx-stable-fastcgi-params< 1.28.2-r0
Redhat18 products
  • nginx< 1:1.24.0-5.module+el9.7.0+24009+e763bdd7.1 | < 2:1.26.3-2.module+el9.7.0+24008+f3da7534 | < 2:1.26.3-2.el10_1 | < 1:1.24.0-2.module+el8.10.0+24013+f603d2af | < 2:1.20.1-24.el9_7.1 | < 2:1.20.1-22.el9_6.4 | < 1:1.20.1-16.el9_4.4 | < 1:1.20.1-14.el9_2.4 | < 1:1.24.0-4.module+el9.6.0+24139+44cdd49a.1 | < 2:1.26.3-1.el10_0.3 | < 1:1.24.0-1.module+el9.4.0+24149+3a2a68ad.3 | < 1:1.20.1-10.el9_0.2 | < 2:1.26.3-1.module+el9.6.0+24147+8a39592f.1
  • nginx-all-modules< 1:1.24.0-5.module+el9.7.0+24009+e763bdd7.1 | < 2:1.26.3-2.module+el9.7.0+24008+f3da7534 | < 2:1.26.3-2.el10_1 | < 1:1.24.0-2.module+el8.10.0+24013+f603d2af | < 2:1.20.1-24.el9_7.1 | < 2:1.20.1-22.el9_6.4 | < 1:1.20.1-16.el9_4.4 | < 1:1.20.1-14.el9_2.4 | < 1:1.24.0-4.module+el9.6.0+24139+44cdd49a.1 | < 2:1.26.3-1.el10_0.3 | < 1:1.24.0-1.module+el9.4.0+24149+3a2a68ad.3 | < 1:1.20.1-10.el9_0.2 | < 2:1.26.3-1.module+el9.6.0+24147+8a39592f.1
  • nginx-core< 1:1.24.0-5.module+el9.7.0+24009+e763bdd7.1 | < 2:1.26.3-2.module+el9.7.0+24008+f3da7534 | < 2:1.26.3-2.el10_1 | < 2:1.20.1-24.el9_7.1 | < 2:1.20.1-22.el9_6.4 | < 1:1.20.1-16.el9_4.4 | < 1:1.20.1-14.el9_2.4 | < 1:1.24.0-4.module+el9.6.0+24139+44cdd49a.1 | < 2:1.26.3-1.el10_0.3 | < 1:1.24.0-1.module+el9.4.0+24149+3a2a68ad.3 | < 2:1.26.3-1.module+el9.6.0+24147+8a39592f.1
  • nginx-core-debuginfo< 1:1.24.0-5.module+el9.7.0+24009+e763bdd7.1 | < 2:1.26.3-2.module+el9.7.0+24008+f3da7534 | < 2:1.26.3-2.el10_1 | < 2:1.20.1-24.el9_7.1 | < 1:1.20.1-16.el9_4.4 | < 1:1.20.1-14.el9_2.4 | < 1:1.24.0-4.module+el9.6.0+24139+44cdd49a.1 | < 2:1.26.3-1.el10_0.3 | < 1:1.24.0-1.module+el9.4.0+24149+3a2a68ad.3 | < 2:1.26.3-1.module+el9.6.0+24147+8a39592f.1
  • nginx-debuginfo< 1:1.24.0-5.module+el9.7.0+24009+e763bdd7.1 | < 2:1.26.3-2.module+el9.7.0+24008+f3da7534 | < 2:1.26.3-2.el10_1 | < 1:1.24.0-2.module+el8.10.0+24013+f603d2af | < 2:1.20.1-24.el9_7.1 | < 1:1.20.1-16.el9_4.4 | < 1:1.20.1-14.el9_2.4 | < 1:1.24.0-4.module+el9.6.0+24139+44cdd49a.1 | < 2:1.26.3-1.el10_0.3 | < 1:1.24.0-1.module+el9.4.0+24149+3a2a68ad.3 | < 1:1.20.1-10.el9_0.2 | < 2:1.26.3-1.module+el9.6.0+24147+8a39592f.1
Wolfi18 products
  • nginx-mainline< 1.29.5-r0
  • nginx-stable< 1.28.2-r0
  • nginx-stable-config< 1.28.2-r0
  • nginx-stable-config-compat< 1.28.2-r0
  • nginx-stable-fastcgi-params< 1.28.2-r0
F55 products
  • nginx gateway fabric≥ 1.2.0, ≤ 1.6.2 | ≥ 2.0.0, < 2.4.1
  • nginx ingress controller≥ 3.4.0, ≤ 3.7.2 | ≥ 4.0.0, ≤ 4.0.1 | ≥ 5.0.0, < 5.3.3
  • nginx_instance_manager≥ 2.15.1, ≤ 2.21.0
  • nginx open source≥ 1.3.0, < 1.29.5 | ≥ 1.3.0, < 1.28.2 | ≥ 1.29.0, < 1.29.5
  • nginx plus≥ R36, < R36 P2 | ≥ R35, < R35 P1 | ≥ R34 (No fix recorded) | ≥ R33 (No fix recorded) | ≥ R32, < R32 P4 | ≥ r33, < r35 | r32 | r32:p1 | r32:p2 | r32:p3 | r33:p1 | r33:p2 | r33:p3 | r34:p1 | r34:p2 | r35 | r36 | r36:p1
Alpine1 product
  • nginx< 1.28.2-r0
Debian1 product
  • nginx< 1.28.1-3 | < 1.22.1-9+deb12u4 | < 1.26.3-3+deb13u2
Mageia1 product
  • nginx< 1.26.3-1.2.mga9
Opensuse1 product
  • nginx&distro=openSUSE Tumbleweed< 1.29.5-1.1
Ubuntu1 product
  • nginx< 1.4.6-1ubuntu3.9+esm6 | < 1.10.3-0ubuntu0.16.04.5+esm7 | < 1.14.0-0ubuntu1.11+esm2 | < 1.18.0-0ubuntu1.7+esm1 | < 1.28.1-3ubuntu1 | < 1.18.0-6ubuntu14.8 | < 1.24.0-2ubuntu7.6 | < 1.28.0-6ubuntu1.1

9 vendors · 64 products

References

42 links
Show all 42 references