Nginx Gateway FabricWeb server / proxy · F5
CVE-2026-1642
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedA vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response from an upstream proxied server. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · moderate confidenceThis vulnerability in NGINX OSS and Plus allows a man-in-the-middle attacker on the upstream server side to inject plain text data into responses when NGINX is configured to proxy to upstream TLS servers. The issue appears to involve improper handling or validation of the TLS connection between NGINX and upstream servers, potentially allowing cleartext injection into what should be an encrypted TLS stream.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data
Nginx Gateway FabricWeb server / proxy
>= 1.2.0, <= 1.6.2>= 2.0.0, < 2.4.1
Nginx Ingress ControllerWeb server / proxy
>= 3.4.0, <= 3.7.2>= 4.0.0, <= 4.0.1>= 5.0.0, < 5.3.3
Nginx Instance ManagerWeb server / proxy
>= 2.15.1, <= 2.21.0
Nginx Open SourceWeb server / proxy
>= 1.3.0, < 1.28.2>= 1.29.0, < 1.29.5
Nginx PlusWeb server / proxy
>= r33, < r35= r32= r33= r34= r35= r36CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- High
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- High
- Availability
- None
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify NGINX versionRun 'nginx -v' or 'nginx-plus -v' to get the installed version, or check the package manager outputAffected if Version matches: Nginx OSS >=1.3.0 and <1.28.2, or >=1.29.0 and <1.29.5; Nginx Plus r32, r33, r34, r35, r36; Nginx Gateway Fabric 1.2.0-1.6.2 or 2.0.0-2.4.0; Nginx Ingress Controller 3.4.0-3.7.2, 4.0.0-4.0.1, or 5.0.0-5.3.2; Nginx Instance Manager 2.15.1-2.21.0
-
Verify proxy to upstream TLS is configuredReview NGINX configuration files for 'proxy_pass https://' directives in location/server blocksAffected if Configuration contains proxy_pass directives pointing to upstream servers over HTTPS (upstream TLS proxying)
-
Check TLS proxy configuration for verification settingsInspect NGINX config for 'proxy_ssl_verify', 'proxy_ssl_trusted_certificate', and 'proxy_ssl_server_name' directives and their valuesAffected if Upstream TLS proxy is configured without proper certificate validation (proxy_ssl_verify off or missing proxy_ssl_trusted_certificate)
Environment is affected if NGINX version is in the vulnerable range AND the configuration proxies to upstream servers over HTTPS.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped1.28.21.29.52.4.1
Ensure NGINX is updated to a version with the fix applied, and review upstream TLS proxy configuration to verify proper certificate validation and TLS protocol handling. Consider implementing additional TLS verification controls in the NGINX configuration.
Nginx Open Source: 1.28.2+ or 1.29.5+ | Nginx Plus: r35+ | Nginx Ingress Controller: 3.7.3+, 4.0.2+, or 5.3.3+ | Nginx Gateway Fabric: 2.4.1+ or 1.7.0+ | Nginx Instance Manager: 2.22.0+
- 1. Identify which NGINX product(s) are in use (Nginx Open Source, Nginx Plus, Nginx Ingress Controller, Nginx Gateway Fabric, or Nginx Instance Manager)
- 2. Determine the currently installed version using the appropriate command: nginx -v for OSS, or check the product documentation for managed versions
- 3. For Nginx Open Source: upgrade to version 1.28.2 or later, or version 1.29.5 or later
- 4. For Nginx Plus: upgrade to version r35 or later
- 5. For Nginx Ingress Controller: upgrade to 3.7.3 or later if using 3.x, 4.0.2 or later if using 4.x, or 5.3.3 or later if using 5.x
- 6. For Nginx Gateway Fabric: upgrade to 2.4.1 or later (if using 2.x), or 1.7.0 or later (if using 1.x)
- 7. For Nginx Instance Manager: upgrade to version 2.22.0 or later
- 8. After upgrade, verify the NGINX service is running correctly and test that proxied TLS connections work as expected
Generated from the published advisory — verify against the referenced sources before acting.
Fix this in Nginx Gateway Fabric
Scoped from the published advisory
- Consultation3.0 h
- Implementation6.0 h
- Testing4.0 h
- Review / QA2.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $4,224.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2026-1642 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2026-1642 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data