CVE-2026-1642

MEDIUM

NGINX OSS 1.3.0-1.28.1 & NGINX Plus r33-r34 TLS Data Authenticity Verification Bypass

Title source: llm

Description

A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response from an upstream proxied server. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

References (2)

Core 2

Core References

Vendor Advisory vendor-advisory

https://my.f5.com/manage/s/article/K000159824

Mailing List, Third Party Advisory

http://www.openwall.com/lists/oss-security/2026/02/05/1

Scores

CVSS v3 5.9

EPSS 0.0033

EPSS Percentile 24.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-345 CWE-349

Status published

Products (10)

f5/nginx_gateway_fabric 1.2.0 - 1.6.2

f5/nginx_ingress_controller 3.4.0 - 3.7.2

f5/nginx_instance_manager 2.15.1 - 2.21.0

f5/nginx_open_source 1.3.0 - 1.28.2

f5/nginx_plus r32 (4 CPE variants)

f5/nginx_plus r33 p1 (3 CPE variants)

f5/nginx_plus r34 p1 (2 CPE variants)

f5/nginx_plus r35

f5/nginx_plus r36 (2 CPE variants)

f5/nginx_plus r33 - r35

Published Feb 04, 2026

Tracked Since Feb 18, 2026