PT-2026-50442 · F5 · Nginx Open Source+1

Published 2026-06-17 · Updated 2026-06-17 · CVE-2026-48142

Mitre

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

NGINX Plus and NGINX Open Source have a vulnerability in the ngx http charset module module. When content is served or proxied through a location block with both source charset utf-8; and a charset directive (for example, charset koi8-r;) configured, remote, unauthenticated attackers can send requests (in conjunction with conditions beyond their control) to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-48142

Affected Products

Nginx Open Source

Nginx Plus

References · 3

• https://my.f5.com/manage/s/article/K000161585 · Vendor Advisory
• https://twitter.com/jedisct1/status/2067287414410719676 · Twitter Post
• https://reddit.com/r/nginx/comments/1u8dt9o/nueva_versi%C3%B3n_1303_y_1312 · Reddit Post