CVE-2026-48142
NGINX ngx_http_charset_module vulnerability
Description
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When content is served or proxied through a location block with both source_charset utf-8; and a charset directive (for example, charset koi8-r;) configured, remote, unauthenticated attackers can send requests (in conjunction with conditions beyond their control) to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
INFO
Published Date :
June 17, 2026, 2:04 p.m.
Last Modified :
June 17, 2026, 2:04 p.m.
Remotely Exploit :
Yes !
Source :
f5
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | 9dacffd4-cb11-413f-8451-fbbfd4ddc0ab | ||||
| CVSS 4.0 | MEDIUM | 9dacffd4-cb11-413f-8451-fbbfd4ddc0ab |
Solution
- Update NGINX to a version that includes the fix.
- Remove duplicate charset directives.
- Review module configurations for proper charset usage.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-48142 vulnerability anywhere in the article.