CVE-2026-42934
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module.
Published May 13, 2026 · updated Jun 18, 2026 · f5 dos
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map and proxy_pass with disabled buffering ("off") directives are configured, unauthenticated attackers can send requests that with conditions beyond the attackers' control to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
May 13, 2026 · NIST NVD
Detected
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map and proxy_pass with disabled buffering ("off") directives are configured, unauthenticated attackers can send requests that with conditions beyond the attackers' control to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure
Jun 18, 2026 · NIST NVD
Updated
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map and proxy_pass with disabled buffering ("off") directives are configured, unauthenticated attackers can send requests that with conditions beyond the attackers' control to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure
Affected
- cpe f5/dosversion unspecified
- cpe f5/dos4.8.0
- cpe f5/nginx gateway fabricversion unspecified
- cpe f5/nginx ingress controllerversion unspecified
- cpe f5/nginx instance managerversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-42934
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-42934
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map and proxy_pass with disabled buffering ("off") directives are configured, unauthenticated attackers can send requests that with conditions be
nvd.nist.gov