A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response from an upstream proxied server. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

redhat RHSA-2026:5581: RHSA-2026:5581: nginx:1.24 security update (Moderate)

redhat RHSA-2026:5599: RHSA-2026:5599: nginx security update (Moderate)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:4705 advisory.

    * nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections (CVE-2026-1642)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-4705 advisory.

    [2:1.26.3-2.0.1]
    - Reference oracle-indexhtml within Requires [Orabug: 33802044]

    [2:1.26.3-2]
    - CVE-2026-1642 nginx: NGINX: Data injection via man-in-the-middle attack       on TLS proxied connections

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-323:01 advisory.

    * nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections (CVE-2026-1642)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:4705 advisory.

    nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency,     performance, and low memory usage.

    Security Fix(es):

    * nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections (CVE-2026-1642)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-4235 advisory.

    [2:1.26.3-2.0.1]
    - Require oracle-indexhtml

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:4235 advisory.

    * nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections (CVE-2026-1642)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:4235 advisory.

    * nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections (CVE-2026-1642)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:4235 advisory.

    nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency,     performance, and low memory usage.

    Security Fix(es):

    * nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections (CVE-2026-1642)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:3638 advisory.

    * nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections (CVE-2026-1642)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-260:01 advisory.

    * nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections (CVE-2026-1642)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-3638 advisory.

    - Resolves: RHEL-146526 - nginx:1.24/nginx: NGINX: Data injection via       man-in-the-middle attack on TLS proxied connections (CVE-2026-1642)
    - Resolves: RHEL-84480 - nginx:1.24/nginx: specially crafted MP4 file may cause       denial of service (CVE-2024-7347)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:3638 advisory.

    nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency,     performance, and low memory usage.

    Security Fix(es):

    * nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections (CVE-2026-1642)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:3638 advisory.

    * nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections (CVE-2026-1642)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of nginx installed on the remote host is prior to 1.28.2-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2NGINX1-2026-010 advisory.

    A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer     Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side--     along with conditions beyond the attacker's control--may be able to inject plain text data into the     response from an upstream proxied server.  Note: Software versions which have reached End of Technical     Support (EoTS) are not evaluated. (CVE-2026-1642)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1436 advisory.

    A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer     Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side--     along with conditions beyond the attacker's control--may be able to inject plain text data into the     response from an upstream proxied server.  Note: Software versions which have reached End of Technical     Support (EoTS) are not evaluated. (CVE-2026-1642)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-cd0705c6a7 advisory.

    nginx-mod-naxsi:

    - Rebuild for 1.28.2

    nginx-mod-brotli:

    - Rebuild for 1.28.2

    nginx-mod-fancyindex:

    - Rebuild for 1.28.2

    nginx-mod-modsecurity:

    - Rebuild for 1.28.2

    nginx-mod-headers-more:

    - Rebuild for 1.28.2

    nginx-mod-vts:

    - Rebuild for 1.28.2

    nginx:

    - Update to 1.28.2
    - fixes CVE-2026-1642
    - move log directory to nginx-filesystem subpackage (PR#20)
    - delete Maxim Dounin's key, it's no longer listed on the nginx website




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-0b8cc86e5b advisory.

    nginx-mod-fancyindex:

    - Rebuild for 1.28.2

    nginx-mod-headers-more:

    - Rebuild for 1.28.2

    nginx-mod-brotli:

    - Rebuild for 1.28.2

    nginx-mod-modsecurity:

    - Rebuild for 1.28.2

    nginx-mod-vts:

    - Rebuild for 1.28.2

    nginx-mod-naxsi:

    - Rebuild for 1.28.2

    nginx:

    - Update to 1.28.2
    - fixes CVE-2026-1642
    - move log directory to nginx-filesystem subpackage (PR#20)
    - delete Maxim Dounin's key, it's no longer listed on the nginx website




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 host has packages installed that are affected by a vulnerability as referenced in the USN-8038-1 advisory.

    It was discovered that nginx incorrectly handled proxying to upstream TLS servers. An attacker could     possibly use this issue to insert plain text data into the response from an upstream proxied server.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 12 / 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6131 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6131-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     February 12, 2026                     https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : nginx     CVE ID         : CVE-2026-1642

    A vulnerability has been discovered in Nginx, a high-performance web     and reverse proxy server: If configured to proxy to an upstream TLS     server, a man-in-the-middle injection attack was possible.

    For the oldstable distribution (bookworm), this problem has been fixed     in version 1.22.1-9+deb12u4.

    For the stable distribution (trixie), this problem has been fixed in     version 1.26.3-3+deb13u2.

    We recommend that you upgrade your nginx packages.

    For the detailed security status of nginx please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/nginx

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its Server response header, the installed version of nginx is from 1.3.0 to 1.29.4. It is, therefore, affected by a vulnerability when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side-along with conditions beyond the attacker's control-may be able to inject plain text data into the response from an upstream proxied server.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer     Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server     sidealong with conditions beyond the attacker's controlmay be able to inject plain text data into the     response from an upstream proxied server. Note: Software versions which have reached End of Technical     Support (EoTS) are not evaluated. (CVE-2026-1642)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
303213	AlmaLinux 10 : nginx (ALSA-2026:4705)	Nessus	Alma Linux Local Security Checks	high
302806	Oracle Linux 10 : nginx (ELSA-2026-4705)	Nessus	Oracle Linux Local Security Checks	high
302781	MiracleLinux 9 : nginx:1.26 (AXSA:2026-323:01)	Nessus	Miracle Linux Local Security Checks	high
302772	RHEL 10 : nginx (RHSA-2026:4705)	Nessus	Red Hat Local Security Checks	high
301992	Oracle Linux 9 : nginx:1.26 (ELSA-2026-4235)	Nessus	Oracle Linux Local Security Checks	high
301898	RockyLinux 9 : nginx:1.26 (RLSA-2026:4235)	Nessus	Rocky Linux Local Security Checks	high
301889	AlmaLinux 9 : nginx:1.26 (ALSA-2026:4235)	Nessus	Alma Linux Local Security Checks	high
301788	RHEL 9 : nginx:1.26 (RHSA-2026:4235)	Nessus	Red Hat Local Security Checks	high
301122	RockyLinux 9 : nginx:1.24 (RLSA-2026:3638)	Nessus	Rocky Linux Local Security Checks	high
301102	MiracleLinux 9 : nginx:1.24 (AXSA:2026-260:01)	Nessus	Miracle Linux Local Security Checks	high
300932	Oracle Linux 9 : nginx:1.24 (ELSA-2026-3638)	Nessus	Oracle Linux Local Security Checks	high
300923	RHEL 9 : nginx:1.24 (RHSA-2026:3638)	Nessus	Red Hat Local Security Checks	high
300876	AlmaLinux 9 : nginx:1.24 (ALSA-2026:3638)	Nessus	Alma Linux Local Security Checks	high
299565	Amazon Linux 2 : nginx, --advisory ALAS2NGINX1-2026-010 (ALASNGINX1-2026-010)	Nessus	Amazon Linux Local Security Checks	high
299529	Amazon Linux 2023 : nginx, nginx-all-modules, nginx-core (ALAS2023-2026-1436)	Nessus	Amazon Linux Local Security Checks	high
299133	Fedora 43 : nginx / nginx-mod-brotli / nginx-mod-fancyindex / etc (2026-cd0705c6a7)	Nessus	Fedora Local Security Checks	high
299132	Fedora 42 : nginx / nginx-mod-brotli / nginx-mod-fancyindex / etc (2026-0b8cc86e5b)	Nessus	Fedora Local Security Checks	high
299038	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 : nginx vulnerability (USN-8038-1)	Nessus	Ubuntu Local Security Checks	high
298908	Debian dsa-6131 : libnginx-mod-http-geoip - security update	Nessus	Debian Local Security Checks	high
115141	Nginx 1.3.0 < 1.29.5 SSL Upstream Injection	Web App Scanning	Component Vulnerability	high
297957	Linux Distros Unpatched Vulnerability : CVE-2026-1642	Nessus	Misc.	high

Detections

Analytics

CVE-2026-1642

high

Tenable Plugins

Coming Soon

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high