CVE-2026-1642
- Source
- https://cve.org/CVERecord?id=CVE-2026-1642
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-1642.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-1642
- Aliases
- Downstream
- Related
- Published
- 2026-02-04T15:16:14.190Z
- Modified
- 2026-03-14T15:05:39.574050Z
- Severity
-
- 8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
- Summary
- [none]
- Details
-
A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response from an upstream proxied server. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- References
Affected packages
Git / github.com/nginx/nginx
Affected ranges
- Type
- GIT
- Repo
- https://github.com/nginx/nginx
- Events
-
IntroducedLast affectedIntroducedFixedIntroducedFixed
- Database specific
{ "versions": [ { "introduced": "1.2.0" }, { "last_affected": "1.6.2" }, { "introduced": "1.3.0" }, { "fixed": "1.28.2" }, { "introduced": "1.29.0" }, { "fixed": "1.29.5" } ] }
- Type
- GIT
- Repo
- https://github.com/nginxinc/kubernetes-ingress
- Events
-
IntroducedFixedIntroducedLast affectedIntroducedLast affectedIntroducedFixed
- Database specific
{ "versions": [ { "introduced": "2.0.0" }, { "fixed": "2.4.1" }, { "introduced": "3.4.0" }, { "last_affected": "3.7.2" }, { "introduced": "4.0.0" }, { "last_affected": "4.0.1" }, { "introduced": "5.0.0" }, { "fixed": "5.3.3" } ] }
Affected versions
release-1.*
release-1.2.0
release-1.3.0
release-1.3.1
release-1.3.10
release-1.3.11
release-1.3.12
release-1.3.13
release-1.3.14
release-1.3.15
release-1.3.16
release-1.3.2
release-1.3.3
release-1.3.4
release-1.3.5
release-1.3.6
release-1.3.7
release-1.3.8
release-1.3.9
release-1.4.0
release-1.5.0
release-1.5.1
release-1.5.10
release-1.5.11
release-1.5.12
release-1.5.13
release-1.5.2
release-1.5.3
release-1.5.4
release-1.5.5
release-1.5.6
release-1.5.7
release-1.5.8
release-1.5.9
release-1.6.0
release-1.6.1
release-1.6.2
v2.*
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.1.1
v2.1.2
v2.2.0
v2.2.1
v2.2.2
v2.3.0
v2.3.1
v2.4.0
v3.*
v3.0.0
v3.1.0
v3.2.0
v3.3.0
v3.7.0
v3.7.1
v3.7.2
v4.*
v4.0.0
v4.0.1
Database specific
unresolved_ranges
[
{
"events": [
{
"introduced": "2.15.1"
},
{
"last_affected": "2.21.0"
}
]
},
{
"events": [
{
"introduced": "r33"
},
{
"fixed": "r35"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "r32-NA"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "r32-p1"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "r32-p2"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "r32-p3"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "r33-p1"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "r33-p2"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "r33-p3"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "r34-p1"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "r34-p2"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "r35-NA"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "r36-NA"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "r36-p1"
}
]
}
]
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-1642.json"