PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-48142 F5 CVE debrief

A vulnerability was found in NGINX Open Source and NGINX Plus. The ngx_http_charset_module module can cause a heap buffer over-read when serving or proxying content through a location block with specific charset configurations. This issue allows remote, unauthenticated attackers to potentially disclose memory or cause a restart. The vulnerability has a CVSS score of 6.3 and a severity of MEDIUM. Users of NGINX Open Source and NGINX Plus should review their configurations and update to patched versions if necessary.

Vendor
F5
Product
NGINX Open Source
CVSS
MEDIUM 6.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-17
Original CVE updated
2026-06-22
Advisory published
2026-06-17
Advisory updated
2026-06-22

Who should care

Users of NGINX Open Source and NGINX Plus should review their configurations and update to patched versions if necessary. This includes administrators, security teams, and operators who manage NGINX deployments. They should assess their exposure and take steps to mitigate the vulnerability.

Technical summary

The ngx_http_charset_module in NGINX Open Source and NGINX Plus has a vulnerability that can lead to a heap buffer over-read. This occurs when content is served or proxied through a location block with both source_charset utf-8; and a charset directive configured. An attacker can exploit this by sending requests under certain conditions, potentially leading to limited disclosure of memory or a restart of the NGINX worker process. The vulnerability has a CVSS score of 6.3 and a severity of MEDIUM.

Defensive priority

Medium priority due to the potential for memory disclosure or service restart.

Recommended defensive actions

  • Review NGINX configurations for vulnerable charset settings.
  • Update to patched versions of NGINX Open Source and NGINX Plus.
  • Monitor for unusual worker process restarts or error messages.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record was published on 2026-06-17T15:16:59.040Z and was last modified on 2026-06-22T16:50:00.903Z. The NVD entry is currently Analyzed. This information is based on the NVD entry and the CVE record. The vulnerability affects NGINX Open Source and NGINX Plus, specifically the ngx_http_charset_module module. The evidence is limited to the information provided in the CVE record and NVD entry.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-06-17T15:16:59.040Z and has not been modified since then. The NVD entry is currently Analyzed.