CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-1642

A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response from an upstream proxied server. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.0

EPSS Ranking 2.4%

CVSS Severity

CVSS v3 Score 5.9

References

Products affected by CVE-2026-1642

F5 » Nginx Gateway Fabric » Version: 1.2.0

cpe:2.3:a:f5:nginx_gateway_fabric:1.2.0
F5 » Nginx Gateway Fabric » Version: 1.6.2

cpe:2.3:a:f5:nginx_gateway_fabric:1.6.2
F5 » Nginx Gateway Fabric » Version: 2.0.0

cpe:2.3:a:f5:nginx_gateway_fabric:2.0.0
F5 » Nginx Gateway Fabric » Version: 2.4.0

cpe:2.3:a:f5:nginx_gateway_fabric:2.4.0
F5 » Nginx Ingress Controller » Version: 3.4.0

cpe:2.3:a:f5:nginx_ingress_controller:3.4.0
F5 » Nginx Ingress Controller » Version: 3.4.1

cpe:2.3:a:f5:nginx_ingress_controller:3.4.1
F5 » Nginx Ingress Controller » Version: 3.4.2

cpe:2.3:a:f5:nginx_ingress_controller:3.4.2
F5 » Nginx Ingress Controller » Version: 3.4.3

cpe:2.3:a:f5:nginx_ingress_controller:3.4.3
F5 » Nginx Ingress Controller » Version: 3.5.0

cpe:2.3:a:f5:nginx_ingress_controller:3.5.0
F5 » Nginx Ingress Controller » Version: 3.5.1

cpe:2.3:a:f5:nginx_ingress_controller:3.5.1
F5 » Nginx Ingress Controller » Version: 3.5.2

cpe:2.3:a:f5:nginx_ingress_controller:3.5.2
F5 » Nginx Ingress Controller » Version: 3.6.0

cpe:2.3:a:f5:nginx_ingress_controller:3.6.0
F5 » Nginx Ingress Controller » Version: 3.6.1

cpe:2.3:a:f5:nginx_ingress_controller:3.6.1
F5 » Nginx Ingress Controller » Version: 3.6.2

cpe:2.3:a:f5:nginx_ingress_controller:3.6.2
F5 » Nginx Ingress Controller » Version: 3.7.0

cpe:2.3:a:f5:nginx_ingress_controller:3.7.0
F5 » Nginx Ingress Controller » Version: 3.7.1

cpe:2.3:a:f5:nginx_ingress_controller:3.7.1
F5 » Nginx Ingress Controller » Version: 3.7.2

cpe:2.3:a:f5:nginx_ingress_controller:3.7.2
F5 » Nginx Ingress Controller » Version: 4.0.0

cpe:2.3:a:f5:nginx_ingress_controller:4.0.0
F5 » Nginx Ingress Controller » Version: 4.0.1

cpe:2.3:a:f5:nginx_ingress_controller:4.0.1
F5 » Nginx Ingress Controller » Version: 5.0.0

cpe:2.3:a:f5:nginx_ingress_controller:5.0.0
F5 » Nginx Ingress Controller » Version: 5.3.0

cpe:2.3:a:f5:nginx_ingress_controller:5.3.0
F5 » Nginx Ingress Controller » Version: 5.3.2

cpe:2.3:a:f5:nginx_ingress_controller:5.3.2
F5 » Nginx Instance Manager » Version: 2.15.1

cpe:2.3:a:f5:nginx_instance_manager:2.15.1
F5 » Nginx Instance Manager » Version: 2.16.0

cpe:2.3:a:f5:nginx_instance_manager:2.16.0
F5 » Nginx Instance Manager » Version: 2.17.0

cpe:2.3:a:f5:nginx_instance_manager:2.17.0
F5 » Nginx Instance Manager » Version: 2.17.1

cpe:2.3:a:f5:nginx_instance_manager:2.17.1
F5 » Nginx Instance Manager » Version: 2.17.2

cpe:2.3:a:f5:nginx_instance_manager:2.17.2
F5 » Nginx Instance Manager » Version: 2.17.3

cpe:2.3:a:f5:nginx_instance_manager:2.17.3
F5 » Nginx Instance Manager » Version: 2.17.4

cpe:2.3:a:f5:nginx_instance_manager:2.17.4
F5 » Nginx Instance Manager » Version: 2.18.0

cpe:2.3:a:f5:nginx_instance_manager:2.18.0
F5 » Nginx Instance Manager » Version: 2.19.0

cpe:2.3:a:f5:nginx_instance_manager:2.19.0
F5 » Nginx Instance Manager » Version: 2.19.1

cpe:2.3:a:f5:nginx_instance_manager:2.19.1
F5 » Nginx Instance Manager » Version: 2.21.0

cpe:2.3:a:f5:nginx_instance_manager:2.21.0
F5 » Nginx Open Source » Version: 1.25.0

cpe:2.3:a:f5:nginx_open_source:1.25.0
F5 » Nginx Open Source » Version: 1.25.1

cpe:2.3:a:f5:nginx_open_source:1.25.1
F5 » Nginx Open Source » Version: 1.25.2

cpe:2.3:a:f5:nginx_open_source:1.25.2
F5 » Nginx Open Source » Version: 1.25.3

cpe:2.3:a:f5:nginx_open_source:1.25.3
F5 » Nginx Open Source » Version: 1.25.4

cpe:2.3:a:f5:nginx_open_source:1.25.4
F5 » Nginx Open Source » Version: 1.26.1

cpe:2.3:a:f5:nginx_open_source:1.26.1
F5 » Nginx Open Source » Version: 1.26.2

cpe:2.3:a:f5:nginx_open_source:1.26.2
F5 » Nginx Open Source » Version: 1.27.0

cpe:2.3:a:f5:nginx_open_source:1.27.0
F5 » Nginx Open Source » Version: 1.29.0

cpe:2.3:a:f5:nginx_open_source:1.29.0
F5 » Nginx Open Source » Version: 1.3.0

cpe:2.3:a:f5:nginx_open_source:1.3.0
F5 » Nginx Open Source » Version: 1.5.13

cpe:2.3:a:f5:nginx_open_source:1.5.13
F5 » Nginx Plus » Version: r32

cpe:2.3:a:f5:nginx_plus:r32
F5 » Nginx Plus » Version: r33

cpe:2.3:a:f5:nginx_plus:r33
F5 » Nginx Plus » Version: r34

cpe:2.3:a:f5:nginx_plus:r34
F5 » Nginx Plus » Version: r35

cpe:2.3:a:f5:nginx_plus:r35
F5 » Nginx Plus » Version: r36

cpe:2.3:a:f5:nginx_plus:r36

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-1642

Products

Pricing

Contact Us