CVE-2026-48142
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk28th percentile — higher than 28% of all known CVEs
Summary
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. Attackers can send crafted requests, leading to a heap buffer over-read in the NGINX worker process, potentially resulting in limited memory disclosure or a restart.
Risk Assessment
This vulnerability may lead to the disclosure of sensitive data or service interruptions, impacting application availability.
Recommendation
It is recommended to update to the latest version of NGINX to mitigate this vulnerability and review charset configurations in location blocks.
Original NVD description (English source)
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When content is served or proxied through a location block with both source_charset utf-8; and a charset directive (for example, charset koi8-r;) configured, remote, unauthenticated attackers can send requests (in conjunction with conditions beyond their control) to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.