CVE-2026-48142

Name of the Vulnerable Software and Affected Versions NGINX Plus (affected versions not specified) NGINX Open Source (affected versions not specified)

Description A heap buffer over-read exists in the ngx http charset module module. This occurs when content is served or proxied through a location block configured with both source charset utf-8; and a charset directive (such as charset koi8-r;). Remote, unauthenticated attackers can send requests that, under specific conditions, cause the NGINX worker process to experience a heap buffer over-read, which is a memory error where the system reads data beyond the end of the intended buffer. This can lead to a restart of the process or limited disclosure of memory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.