Out-of-bounds read in NGINX Plus and NGINX Open Source - CVE-2026-48142

Vulnerability identifier: #VU134864

CSH Severity: Medium

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-48142

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to disclose limited memory contents or cause a worker process restart.

The vulnerability exists due to out-of-bounds read in ngx_http_charset_module when serving or proxying content through a location block configured with both source_charset utf-8 and a charset directive. A remote attacker can send crafted requests to disclose limited memory contents or cause a worker process restart.

This is a data plane issue only, and exploitation also depends on conditions beyond the attacker's control.

NGINX Plus
NGINX Open Source
Debian Linux
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
Server Applications Module
openSUSE Leap
openEuler
Anolis OS
Fedora
nginx-mod-js-challenge
nginx-mod-vts
nginx-mod-fancyindex
nginx-mod-headers-more
nginx-mod-brotli
nginx-mod-modsecurity
nginx-mod-naxsi
nginx-mod-stream
nginx
nginx-debuginfo
nginx-debugsource
nginx-mod-devel
nginx-mod-http-image-filter
nginx-mod-http-perl
nginx-mod-http-xslt-filter
nginx-mod-mail
nginx-all-modules
nginx-filesystem
nginx-help
nginx-source
compat-nginx-mod-http-image-filter
compat-nginx-debugsource
compat-nginx-debuginfo
compat-nginx
compat-nginx-mod-http-xslt-filter
compat-nginx-all-modules
compat-nginx-filesystem
compat-nginx-help
compat-nginx-mod-stream
compat-nginx-mod-mail
compat-nginx-mod-http-perl
nginx (Debian package)
nginx-doc
nginx-core

Install security update from vendor's website.

NGINX Plus - addressed in versions R36 P6, 37.0.2.1
NGINX Open Source - addressed in versions 1.30.3, 1.31.2
nginx-mod-js-challenge - addressed in versions 0^20230517.gitda6852d-9.fc44, 0^20230517.gitda6852d-9.fc45
nginx-mod-vts - addressed in versions 0.2.4-11.fc43, 0.2.4-11.fc44, 0.2.4-11.fc45
nginx-mod-fancyindex - addressed in versions 0.6.0-6.fc43, 0.6.0-6.fc44, 0.6.0-6.fc45
nginx-mod-headers-more - addressed in versions 0.39-11.fc43, 0.39-11.fc44, 0.39-11.fc45
nginx-mod-brotli - addressed in versions 1.0.0~rc-11.fc43, 1.0.0~rc-11.fc44, 1.0.0~rc-11.fc45
nginx-mod-modsecurity - addressed in versions 1.0.4-12.fc43, 1.0.4-12.fc44, 1.0.4-12.fc45
nginx-mod-naxsi - addressed in versions 1.6-19.fc43, 1.6-19.fc44, 1.6-19.fc45
nginx-mod-stream - addressed in versions 1.21.5-15, 1.21.5-17, 1.24.0-13
nginx - addressed in versions 1.21.5-15, 1.21.5-17, 1.24.0-13
nginx-debuginfo - addressed in versions 1.21.5-15, 1.21.5-17, 1.24.0-13
nginx-debugsource - addressed in versions 1.21.5-15, 1.21.5-17, 1.24.0-13
nginx-mod-devel - addressed in versions 1.21.5-15, 1.21.5-17, 1.24.0-13
nginx-mod-http-image-filter - addressed in versions 1.21.5-15, 1.21.5-17, 1.24.0-13
nginx-mod-http-perl - addressed in versions 1.21.5-15, 1.21.5-17, 1.24.0-13
nginx-mod-http-xslt-filter - addressed in versions 1.21.5-15, 1.21.5-17, 1.24.0-13
nginx-mod-mail - addressed in versions 1.21.5-15, 1.21.5-17, 1.24.0-13
nginx-all-modules - addressed in versions 1.21.5-15, 1.21.5-17, 1.24.0-13
nginx-filesystem - addressed in versions 1.21.5-15, 1.21.5-17, 1.24.0-13
nginx-help - addressed in versions 1.21.5-17, 1.24.0-13
nginx-debugsource - update to 1.21.5-150600.10.24.1
nginx-debuginfo - update to 1.21.5-150600.10.24.1
nginx - update to 1.21.5-150600.10.24.1
nginx-source - update to 1.21.5-150600.10.24.1
compat-nginx-mod-http-image-filter - update to 1.24.0-13
compat-nginx-debugsource - update to 1.24.0-13
compat-nginx-debuginfo - update to 1.24.0-13
compat-nginx - update to 1.24.0-13
compat-nginx-mod-http-xslt-filter - update to 1.24.0-13
compat-nginx-all-modules - update to 1.24.0-13
compat-nginx-filesystem - update to 1.24.0-13
compat-nginx-help - update to 1.24.0-13
compat-nginx-mod-stream - update to 1.24.0-13
compat-nginx-mod-mail - update to 1.24.0-13
compat-nginx-mod-http-perl - update to 1.24.0-13
nginx (Debian package) - update to 1.26.3-3+deb13u7
nginx-mod-http-image-filter - update to 1.30.2-2
nginx-filesystem - update to 1.30.2-2
nginx-doc - update to 1.30.2-2
nginx-all-modules - update to 1.30.2-2
nginx-mod-stream - update to 1.30.2-2
nginx-mod-mail - update to 1.30.2-2
nginx-mod-http-xslt-filter - update to 1.30.2-2
nginx-mod-http-perl - update to 1.30.2-2
nginx-mod-devel - update to 1.30.2-2
nginx-core - update to 1.30.2-2
nginx - update to 1.30.2-2
nginx - addressed in versions 1.30.3-1.fc43, 1.30.3-1.fc44, 1.30.3-1.fc45

• https://my.f5.com/manage/s/article/K000161585

• Multiple vulnerabilities in NGINX
• Fedora 45 update for nginx, nginx-mod-brotli, nginx-mod-fancyindex, nginx-mod-headers-more, nginx-mod-js-challenge, nginx-mod-modsecurity, nginx-mod-naxsi, nginx-mod-vts
• Fedora 44 update for nginx, nginx-mod-brotli, nginx-mod-fancyindex, nginx-mod-headers-more, nginx-mod-js-challenge, nginx-mod-modsecurity, nginx-mod-naxsi, nginx-mod-vts
• Fedora 43 update for nginx, nginx-mod-brotli, nginx-mod-fancyindex, nginx-mod-headers-more, nginx-mod-modsecurity, nginx-mod-naxsi, nginx-mod-vts
• Debian update for nginx
• openEuler 24.03 LTS SP3 update for nginx
• openEuler 24.03 LTS SP1 update for nginx
• openEuler 22.03 LTS SP4 update for nginx
• openEuler 20.03 LTS SP4 update for nginx
• Anolis OS update for nginx
• SUSE update for nginx