CVE-2026-42946 NGINX ngx_http_scgi_module and ngx_http_uwsgi_module vulnerability
An attacker with MITM capabilities can read NGINX worker memory or cause a restart when SCGI or UWSGI modules are configured.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-42946?
CVE-2026-42946 is a high-severity vulnerability in F5 NGINX Open Source, published on 13 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data. When scgi_pass or uwsgi_pass is configured, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to read the memory of the NGINX worker process or restart it. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Which versions are affected by CVE-2026-42946?
2 open source packages ship an affected version, including nginx and nginx-gateway. It affects 7 products.
| Package | Affected | Fixed in |
|---|---|---|
nginx Bitnami | From 0.8.42 | 1.30.1 |
nginx-gateway Bitnami | From 0.8.42 | 1.30.1 |
Products include F5 Dos, F5 Nginx Gateway Fabric, F5 Nginx Ingress Controller, F5 Nginx Instance Manager, F5 Nginx Open Source, F5 Nginx Plus and 1 more.
How do I fix CVE-2026-42946?
Upgrade nginx to 1.30.1 or later.
Is CVE-2026-42946 being exploited?
There is no known exploitation of CVE-2026-42946 in the wild and no public exploit code.
Other vulnerabilities in F5 NGINX Open Source
- CVE-2026-42055 NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability
- CVE-2026-42945 NGINX ngx_http_rewrite_module vulnerability
- CVE-2026-40460 NGINX ngx_quic_module vulnerability
- CVE-2026-48142 NGINX ngx_http_charset_module vulnerability
- CVE-2026-40701 NGINX ngx_http_ssl_module vulnerability
Sources
Also known as ALPINE-CVE-2026-42946, AZL-86859, BELL-CVE-2026-42946, BIT-nginx-2026-42946, BIT-nginx-gateway-2026-42946, CLSA-2026-1781092483 and 20 more.