CVE-2026-42934
Medium
Description
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map and proxy_pass with disabled buffering ("off") directives are configured, unauthenticated attackers can send requests that with conditions beyond the attackers' control to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
SeverityMedium
CVSS4.8
Exploit probability—
Product
F5 Nginx Gateway Fabric
PublishedMay 13, 2026
First seenMay 13, 2026
Weakness typeCWE-125Out-of-bounds read
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| f5 nginx_gateway_fabric | 1.3.0 ≤ v ≤ 1.6.2, 2.0.0 ≤ v ≤ 2.6.0 | — |
| f5 dos | 4.3.0 ≤ v ≤ 4.7.0, 4.8.0 | — |
| f5 nginx_ingress_controller | 3.5.0 ≤ v ≤ 3.7.2, 4.0.0 ≤ v ≤ 4.0.1, 5.0.0 ≤ v ≤ 5.4.2 | — |
| f5 nginx_instance_manager | 2.16.0 ≤ v ≤ 2.22.0 | — |
| f5 nginx_open_source | 0.3.50 ≤ v ≤ 0.9.7, 1.0.0 ≤ v ≤ 1.30.0 | — |
| f5 nginx_plus | r32 ≤ v ≤ r36 | — |
| f5 waf | 4.9.0 ≤ v ≤ 4.16.0, 5.1.0 ≤ v ≤ 5.8.0, 5.9.0 ≤ v ≤ 5.12.1 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.