Quick answers
- Is CVE-2026-48142 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-48142 being exploited in the wild.
- How severe is CVE-2026-48142?
- Medium severity, with a CVSS score of 4.8, published 17 June 2026.
- Which products and versions are affected?
- F5 Nginx Plus R36 P0 to R36 P5, 37.0 to 37.0.2.0.
- Is there a fix for CVE-2026-48142?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-48142 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-48142?
- Check whether you run F5 Nginx Plus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A heap buffer over-read vulnerability exists in the ngx_http_charset_module of NGINX. The flaw is triggered when a location block is configured with both 'source_charset utf-8;' and a 'charset' directive (e.g., 'charset koi8-r;'). A remote, unauthenticated attacker can exploit this by sending specific requests that, in conjunction with certain environmental conditions, cause the NGINX worker process to read beyond allocated buffer boundaries. This results in either limited disclosure of memory contents or a worker process crash (DoS). The vulnerability is tracked as CWE-125. Patches are available in NGINX Open Source 1.31.2, 1.30.3, and NGINX Plus R36 P6 and 37.0.2.1.
Affected products
- F5 NGINX Open Source 1.13.10 to 1.31.1, 1.30.0 to 1.30.2
- F5 NGINX Plus R36 P0 to R36 P5, 37.0 to 37.0.2.0
Timeline
- 2026-06-17: advisory: Initial disclosure by F5 Networks
- 2026-06-17: disclosed