CVE-2026-1642 NGINX vulnerability
Man-in-the-middle attackers can inject plain text into TLS-proxied responses in NGINX when configured to proxy to upstream TLS servers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-1642?
CVE-2026-1642 is a high-severity vulnerability in F5 NGINX Open Source, published on 4 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response from an upstream proxied server. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Which versions are affected by CVE-2026-1642?
2 open source packages ship an affected version, including nginx and nginx-gateway. It affects 5 products.
| Package | Affected | Fixed in |
|---|---|---|
nginx Bitnami | From 1.3.0 | 1.28.4, 1.29.5 |
nginx-gateway Bitnami | From 1.3.0 | 1.29.5 |
Linux distribution packages (38)
nginx-all-modules AlmaLinux:10 | All versions | 2:1.26.3-2.el10_1 |
nginx-filesystem AlmaLinux:10 | All versions | 2:1.26.3-2.el10_1 |
nginx AlmaLinux:8 | All versions | 1:1.24.0-2.module_el8.10.0+4143+ec3e7d32.alma.1 |
nginx-all-modules AlmaLinux:8 | All versions | 1:1.24.0-2.module_el8.10.0+4143+ec3e7d32.alma.1 |
nginx-filesystem AlmaLinux:8 | All versions | 1:1.24.0-2.module_el8.10.0+4143+ec3e7d32.alma.1 |
nginx-mod-devel AlmaLinux:8 | All versions | 1:1.24.0-2.module_el8.10.0+4143+ec3e7d32.alma.1 |
nginx-mod-http-image-filter AlmaLinux:8 | All versions | 1:1.24.0-2.module_el8.10.0+4143+ec3e7d32.alma.1 |
nginx-mod-http-perl AlmaLinux:8 | All versions | 1:1.24.0-2.module_el8.10.0+4143+ec3e7d32.alma.1 |
nginx-mod-http-xslt-filter AlmaLinux:8 | All versions | 1:1.24.0-2.module_el8.10.0+4143+ec3e7d32.alma.1 |
nginx-mod-mail AlmaLinux:8 | All versions | 1:1.24.0-2.module_el8.10.0+4143+ec3e7d32.alma.1 |
nginx-mod-stream AlmaLinux:8 | All versions | 1:1.24.0-2.module_el8.10.0+4143+ec3e7d32.alma.1 |
nginx AlmaLinux:9 | All versions | 1:1.24.0-5.module_el9.7.0+212+9d3c155a.1.alma.1 |
nginx AlmaLinux:9 | All versions | 2:1.20.1-24.el9_7.1.alma.1 |
nginx AlmaLinux:9 | All versions | 2:1.26.3-2.module_el9.7.0+215+8d94e91c |
nginx-all-modules AlmaLinux:9 | All versions | 1:1.24.0-5.module_el9.7.0+212+9d3c155a.1.alma.1 |
nginx-all-modules AlmaLinux:9 | All versions | 2:1.20.1-24.el9_7.1.alma.1 |
nginx-all-modules AlmaLinux:9 | All versions | 2:1.26.3-2.module_el9.7.0+215+8d94e91c |
nginx-core AlmaLinux:9 | All versions | 1:1.24.0-5.module_el9.7.0+212+9d3c155a.1.alma.1 |
nginx-core AlmaLinux:9 | All versions | 2:1.20.1-24.el9_7.1.alma.1 |
nginx-core AlmaLinux:9 | All versions | 2:1.26.3-2.module_el9.7.0+215+8d94e91c |
nginx-filesystem AlmaLinux:9 | All versions | 1:1.24.0-5.module_el9.7.0+212+9d3c155a.1.alma.1 |
nginx-filesystem AlmaLinux:9 | All versions | 2:1.20.1-24.el9_7.1.alma.1 |
nginx-filesystem AlmaLinux:9 | All versions | 2:1.26.3-2.module_el9.7.0+215+8d94e91c |
nginx-mod-devel AlmaLinux:9 | All versions | 1:1.24.0-5.module_el9.7.0+212+9d3c155a.1.alma.1 |
nginx-mod-devel AlmaLinux:9 | All versions | 2:1.20.1-24.el9_7.1.alma.1 |
nginx-mod-devel AlmaLinux:9 | All versions | 2:1.26.3-2.module_el9.7.0+215+8d94e91c |
nginx-mod-http-image-filter AlmaLinux:9 | All versions | 1:1.24.0-5.module_el9.7.0+212+9d3c155a.1.alma.1 |
nginx-mod-http-image-filter AlmaLinux:9 | All versions | 2:1.20.1-24.el9_7.1.alma.1 |
nginx-mod-http-image-filter AlmaLinux:9 | All versions | 2:1.26.3-2.module_el9.7.0+215+8d94e91c |
nginx-mod-http-perl AlmaLinux:9 | All versions | 1:1.24.0-5.module_el9.7.0+212+9d3c155a.1.alma.1 |
nginx-mod-http-perl AlmaLinux:9 | All versions | 2:1.20.1-24.el9_7.1.alma.1 |
nginx-mod-http-perl AlmaLinux:9 | All versions | 2:1.26.3-2.module_el9.7.0+215+8d94e91c |
nginx-mod-http-xslt-filter AlmaLinux:9 | All versions | 1:1.24.0-5.module_el9.7.0+212+9d3c155a.1.alma.1 |
nginx-mod-http-xslt-filter AlmaLinux:9 | All versions | 2:1.20.1-24.el9_7.1.alma.1 |
nginx-mod-http-xslt-filter AlmaLinux:9 | All versions | 2:1.26.3-2.module_el9.7.0+215+8d94e91c |
nginx-mod-mail AlmaLinux:9 | All versions | 1:1.24.0-5.module_el9.7.0+212+9d3c155a.1.alma.1 |
nginx-mod-mail AlmaLinux:9 | All versions | 2:1.20.1-24.el9_7.1.alma.1 |
nginx-mod-mail AlmaLinux:9 | All versions | 2:1.26.3-2.module_el9.7.0+215+8d94e91c |
Products include F5 Nginx Gateway Fabric, F5 Nginx Ingress Controller, F5 Nginx Instance Manager, F5 Nginx Open Source, F5 Nginx Plus.
How do I fix CVE-2026-1642?
Upgrade nginx to a fixed version for your release line: 1.28.4 or 1.29.5.
Is CVE-2026-1642 being exploited?
There is no known exploitation of CVE-2026-1642 in the wild and no public exploit code.
Other vulnerabilities in F5 NGINX Open Source
Sources
Also known as ALPINE-CVE-2026-1642, ALSA-2026:3638, ALSA-2026:4235, ALSA-2026:4705, ALSA-2026:5581, ALSA-2026:5599 and 49 more.