SB2026020501 - Spoofing attack in nginx and NGINX Plus
Published: February 5, 2026
Security Bulletin ID
SB2026020501
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Acceptance of extraneous untrusted data with trusted data (CVE-ID: CVE-2026-1642)
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to incorrect handling of trusted and untrusted data when configured to proxy to upstream Transport Layer Security (TLS) servers. A remote unauthenticated attacker with an MITM position on the upstream server side can inject plain text data into the responses from an upstream proxied server and send them to clients.
Remediation
Install update from vendor's website.