CVE-2026-42934: F5 NGINX heap buffer over-read in ngx_http_charset_module

CVE-2026-42934 · Severity: medium · CVSS 4.8 · Published 2026-05-13

NGINX Plus and NGINX Open Source, widely used web servers and load balancers, contain a vulnerability in their character set handling module. An unauthenticated attacker can send specific web requests that may cause the server to crash or leak small amounts of internal memory. This could lead to temporary service outages or the exposure of sensitive technical data.

Technologies: F5 Nginx Gateway Fabric, F5 Nginx Ingress Controller, F5 Nginx Plus, NGINX Open Source. Vendors: F5, NGINX.

Quick answers

Is CVE-2026-42934 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42934 being exploited in the wild.
How severe is CVE-2026-42934?
Medium severity, with a CVSS score of 4.8, published 13 May 2026.
Which products and versions are affected?
F5 Nginx Gateway Fabric 1.3.0-1.6.2, 2.0.0-2.6.0; F5 Nginx Ingress Controller 4.0.0-4.0.1, 3.5.0-3.7.2, 5.0.0-5.4.2; F5 Nginx Plus R32 before R32 P6, R36 before R36 P4.
Is there a fix for CVE-2026-42934?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-42934 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-42934?
Check whether you run F5 Nginx Gateway Fabric, F5 Nginx Ingress Controller, F5 Nginx Plus or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap buffer over-read vulnerability exists in the ngx_http_charset_module of NGINX. The flaw is triggered when the 'charset', 'source_charset', and 'charset_map' directives are used in conjunction with 'proxy_pass' while buffering is explicitly disabled ('proxy_buffering off'). An unauthenticated remote attacker can exploit this by sending crafted requests, though successful exploitation depends on conditions beyond the attacker's direct control. Impact includes a crash of the NGINX worker process (DoS) or limited disclosure of memory contents. Patches are available in NGINX Plus R32 P6, R36 P4, and NGINX Open Source 1.30.1/1.31.0.

Affected products

  • F5 NGINX Plus R32 before R32 P6, R36 before R36 P4
  • F5 NGINX Open Source 0.3.50 to 1.30.0
  • F5 NGINX Ingress Controller 4.0.0-4.0.1, 3.5.0-3.7.2, 5.0.0-5.4.2
  • F5 NGINX Gateway Fabric 1.3.0-1.6.2, 2.0.0-2.6.0

Timeline

  • 2026-05-13: advisory: Initial advisory published by F5
  • 2026-05-13: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.