NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When content is served or proxied through a location block with both source_charset utf-8; and a charset directive (for example, charset koi8-r;) configured, remote, unauthenticated attackers can send requests (in conjunction with conditions beyond their control) to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3329-1 advisory.

    This update for nginx fixes the following issues

    - CVE-2026-42055: heap-based buffer overflow in the `ngx_http_proxy_v2_module` and `ngx_http_grpc_module`     modules       (bsc#1268492).
    - CVE-2026-48142: heap buffer over-read in the `ngx_http_charset_module` module (bsc#1268495).
    - Remote denial of service via the HTTP/2 bomb exploit (bsc#1267525).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22943-1 advisory.

    This update for nginx fixes the following issues

    - CVE-2026-40460: bypass of authorization and bypass of rate limiting when NGINX is configured to use the     HTTP/3 QUIC module (bsc#1265228).
    - CVE-2026-42055: heap-based buffer overflow in the ngx_http_proxy_v2_module and ngx_http_grpc_module     modules (bsc#1268492).
    - CVE-2026-48142: heap buffer over-read in the ngx_http_charset_module module (bsc#1268495).
    - HTTP2-BOMB denial of service (bsc#1267525).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21439-1 advisory.

    This update for nginx fixes the following issues

    - CVE-2026-40460: bypass of authorization and bypass of rate limiting when NGINX is configured to use the     HTTP/3 QUIC module (bsc#1265228).
    - CVE-2026-42055: heap-based buffer overflow in the ngx_http_proxy_v2_module and ngx_http_grpc_module     modules (bsc#1268492).
    - CVE-2026-48142: heap buffer over-read in the ngx_http_charset_module module (bsc#1268495).
    - HTTP2-BOMB denial of service (bsc#1267525).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1922 advisory.

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and     ngx_http_grpc_module modules. This vulnerability exists when the proxy_http_version to 2 or grpc_pass     directives are used to proxy HTTP/2 traffic, the ignore_invalid_headers directive is set to off, and the     large_client_header_buffers directive size is larger than 2 megabytes. A remote, unauthenticated attacker,     along with conditions beyond their control, could send large headers while creating an upstream request.
    This may cause a heap-based buffer overflow in the NGINX worker process leading to a restart.
    Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR)     disabled or when the attacker can bypass ASLR.

    Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
    (CVE-2026-42055)

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When content     is served or proxied through a location block with both source_charset utf-8; and a charset directive (for     example, charset koi8-r;) configured, remote, unauthenticated attackers can send requests (in conjunction     with conditions beyond their control) to cause a heap buffer over-read in the NGINX worker process,     leading to limited disclosure of memory or a restart.

    Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
    (CVE-2026-48142)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its Server response header, the installed version of nginx is prior to 1.30.3 or 1.31.x prior to 1.31.2. It is, therefore, affected by the following issues :

- A Use-After-Free in the ngx_http_v3_module module allows a remote unauthenticated attacker to send a specially crafted HTTP/3 session that reopens a QPACK encoder stream, causing a worker process restart or, on systems with ASLR disabled, arbitrary code execution. (CVE-2026-42530)

- A heap-based buffer overflow in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules allows a remote unauthenticated attacker to send large headers during upstream request creation when proxy_http_version 2 or grpc_pass is used with ignore_invalid_headers off and large_client_header_buffers configured above 2 megabytes, causing a worker process restart or, on systems with ASLR disabled, arbitrary code execution. (CVE-2026-42055)

- A heap buffer over-read (CWE-125) in the ngx_http_charset_module module allows a remote unauthenticated attacker to cause limited memory disclosure or a worker process restart when content is served or proxied through a location block configured with both source_charset utf-8 and a charset conversion directive. (CVE-2026-48142)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of nginx installed on the remote host is prior to 1.30.3-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NGINX1-2026-014 advisory.

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and     ngx_http_grpc_module modules. This vulnerability exists when the proxy_http_version to 2 or grpc_pass     directives are used to proxy HTTP/2 traffic, the ignore_invalid_headers directive is set to off, and the     large_client_header_buffers directive size is larger than 2 megabytes. A remote, unauthenticated attacker,     along with conditions beyond their control, could send large headers while creating an upstream request.
    This may cause a heap-based buffer overflow in the NGINX worker process leading to a restart.
    Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR)     disabled or when the attacker can bypass ASLR.

    Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
    (CVE-2026-42055)

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When content     is served or proxied through a location block with both source_charset utf-8; and a charset directive (for     example, charset koi8-r;) configured, remote, unauthenticated attackers can send requests (in conjunction     with conditions beyond their control) to cause a heap buffer over-read in the NGINX worker process,     leading to limited disclosure of memory or a restart.

    Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
    (CVE-2026-48142)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4667 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4667-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/          Carlos Henrique Lima Melara     July 03, 2026                                 https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : nginx     Version        : 1.22.1-9+deb12u9     CVE ID         : CVE-2026-42055 CVE-2026-48142     Debian Bug     : 1140359 1140361

    Multiple vulnerabilities were discoverd in Nginx, a high-performance web     and reverse proxy server, which could result in remote code execution,     denial of service or memory disclosure.

    CVE-2026-42055

        NGINX Open Source has a vulnerability in the ngx_http_proxy_v2_module and         ngx_http_grpc_module modules. This vulnerability exists when the         proxy_http_version to 2 or grpc_pass directives are used to proxy HTTP/2         traffic, the ignore_invalid_headers directive is set to off, and the         large_client_header_buffers directive size is larger than 2 megabytes. A         remote, unauthenticated attacker, along with conditions beyond their         control, could send large headers while creating an upstream request. This         may cause a heap-based buffer overflow in the NGINX worker process leading         to a restart. Additionally, attackers can execute code on systems with         Address Space Layout Randomization (ASLR) disabled or when the attacker can         bypass ASLR.

    CVE-2026-48142

       NGINX Open Source has a vulnerability in the ngx_http_charset_module module.
       When content is served or proxied through a location block with both        source_charset utf-8; and a charset directive (for example, charset koi8-r;)        configured, remote, unauthenticated attackers can send requests (in        conjunction with conditions beyond their control) to cause a heap buffer        over-read in the NGINX worker process, leading to limited disclosure of        memory or a restart.

    For Debian 12 bookworm, these problems have been fixed in version     1.22.1-9+deb12u9.

    We recommend that you upgrade your nginx packages.

    For the detailed security status of nginx please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/nginx

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4660 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4660-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/          Carlos Henrique Lima Melara     June 30, 2026                                 https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : nginx     Version        : 1.18.0-6.1+deb11u8     CVE ID         : CVE-2026-42055 CVE-2026-48142     Debian Bug     : 1138794 1140359 1140361

    Multiple vulnerabilities were discoverd in Nginx, a high-performance web     and reverse proxy server, which could result in remote code execution,     denial of service or memory disclosure.

    CVE-2026-42055

        NGINX Open Source has a vulnerability in the ngx_http_proxy_v2_module and         ngx_http_grpc_module modules. This vulnerability exists when the         proxy_http_version to 2 or grpc_pass directives are used to proxy HTTP/2         traffic, the ignore_invalid_headers directive is set to off, and the         large_client_header_buffers directive size is larger than 2 megabytes. A         remote, unauthenticated attacker, along with conditions beyond their         control, could send large headers while creating an upstream request. This         may cause a heap-based buffer overflow in the NGINX worker process leading         to a restart. Additionally, attackers can execute code on systems with         Address Space Layout Randomization (ASLR) disabled or when the attacker can         bypass ASLR.

    CVE-2026-48142

       NGINX Open Source has a vulnerability in the ngx_http_charset_module module.
       When content is served or proxied through a location block with both        source_charset utf-8; and a charset directive (for example, charset koi8-r;)        configured, remote, unauthenticated attackers can send requests (in        conjunction with conditions beyond their control) to cause a heap buffer        over-read in the NGINX worker process, leading to limited disclosure of        memory or a restart.

    No CVE assigned yet

        HTTP/2 Bomb denial of service

    For Debian 11 bullseye, these problems have been fixed in version     1.18.0-6.1+deb11u8.

    We recommend that you upgrade your nginx packages.

    For the detailed security status of nginx please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/nginx

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6374 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6374-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     June 30, 2026                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : nginx     CVE ID         : CVE-2026-42055 CVE-2026-48142     Debian Bug     : 1140359 1140361

    Multiple vulnerabilities were discoverd in Nginx, a high-performance web     and reverse proxy server, which could result in remote code execution,     denial of service or memory disclosure.

    For the stable distribution (trixie), these problems have been fixed in     version 1.26.3-3+deb13u7.

    We recommend that you upgrade your nginx packages.

    For the detailed security status of nginx please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/nginx

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-9d7328702e advisory.

    nginx-mod-headers-more:

    - Rebuild for 1.30.3

    nginx-mod-brotli:

    - Rebuild for 1.30.3

    nginx-mod-vts:

    - Rebuild for 1.30.3

    nginx-mod-modsecurity:

    - Rebuild for 1.30.3

    nginx-mod-fancyindex:

    - Rebuild for 1.30.3

    nginx-mod-naxsi:

    - Rebuild for 1.30.3

    nginx:

    - update to 1.30.3
    - fixes CVE-2026-42055, CVE-2026-42530 and CVE-2026-48142




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-b8e751787c advisory.

    nginx-mod-brotli:

    - Rebuild for 1.30.3

    nginx-mod-fancyindex:

    - Rebuild for 1.30.3

    nginx-mod-vts:

    - Rebuild for 1.30.3

    nginx-mod-modsecurity:

    - Rebuild for 1.30.3

    nginx-mod-headers-more:

    - Rebuild for 1.30.3

    nginx-mod-naxsi:

    - Rebuild for 1.30.3

    nginx-mod-js-challenge:

    - Rebuild for 1.30.3

    nginx:

    - update to 1.30.3
    - fixes CVE-2026-42055, CVE-2026-42530 and CVE-2026-48142




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8458-1 advisory.

    It was discovered that nginx incorrectly handled large headers when proxying HTTP/2 traffic. A remote     attacker could use this issue to cause nginx to crash, resulting in a denial of service, or possibly     execute arbitrary code. The default compiler options for affected releases should reduce the vulnerability     to a denial of service. (CVE-2026-42055)

    It was discovered that nginx incorrectly handled character set conversion under certain circumstances. A     remote attacker could possibly use this issue to obtain sensitive information or cause nginx to crash,     resulting in a denial of service. (CVE-2026-48142)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The installed version of nginx is 0.3.50 prior to 1.30.3, or 1.31.x prior to 1.31.2. It is, therefore, affected by the following issue:

  - NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When content is     served or proxied through a location block with both source_charset utf-8; and a charset directive (for example,     charset koi8-r;) configured, remote, unauthenticated attackers can send requests (in conjunction with conditions     beyond their control) to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure     of memory or a restart. Note: Software versions which have reached End of Technical Support (EoTS) are not     evaluated. (CVE-2026-48142)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 46b654f8-6b28-11f1-b8e5-3497f65b111b advisory.

    The nginx developers report:

           A heap memory buffer overflow vulnerability when using the            ignore_invalid_headers off; and large_client_header_buffers            directives with large configured values while proxying a specially            crafted request to an HTTP/2 or gRPC backend may allow memory            corruption or a segmentation fault in a worker process            (CVE-2026-42055).


           A heap memory buffer overread vulnerability while handling a            specially crafted response with decoding from UTF-8 via the            charset_map directive may allow limited disclosure of worker            process memory or a segmentation fault in a worker process            (CVE-2026-48142).


Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 08b0c0f6-6a85-11f1-b8e5-3497f65b111b advisory.

    The nginx developers report:

           A use-after-free vulnerability when using HTTP/3 and processing a            specially crafted QUIC session may allow memory corruption or a            segmentation fault in a worker process (CVE-2026-42530).


           A heap memory buffer overflow vulnerability when using the            ignore_invalid_headers off; and large_client_header_buffers            directives with large configured values while proxying a specially            crafted request to an HTTP/2 or gRPC backend may allow memory            corruption or a segmentation fault in a worker process            (CVE-2026-42055).


           A heap memory buffer overread vulnerability while handling a            specially crafted response with decoding from UTF-8 via the            charset_map directive may allow limited disclosure of worker            process memory or a segmentation fault in a worker process            (CVE-2026-48142).


Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When content     is served or proxied through a location block with both source_charset utf-8; and a charset directive (for     example, charset koi8-r;) configured, remote, unauthenticated attackers can send requests (in conjunction     with conditions beyond their control) to cause a heap buffer over-read in the NGINX worker process,     leading to limited disclosure of memory or a restart. Note: Software versions which have reached End of     Technical Support (EoTS) are not evaluated. (CVE-2026-48142)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 45 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-e212182e6e advisory.

    nginx-mod-brotli:

    - Rebuild for 1.30.3

    nginx-mod-fancyindex:

    - Rebuild for 1.30.3

    nginx-mod-modsecurity:

    - Rebuild for 1.30.3

    nginx-mod-headers-more:

    - Rebuild for 1.30.3

    nginx-mod-naxsi:

    - Rebuild for 1.30.3

    nginx-mod-js-challenge:

    - Rebuild for 1.30.3

    nginx-mod-vts:

    - Rebuild for 1.30.3

    nginx:

    - update to 1.30.3
    - fixes CVE-2026-42055, CVE-2026-42530 and CVE-2026-48142



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
330577	SUSE SLES15 Security Update : nginx (SUSE-SU-2026:3329-1)	Nessus	SuSE Local Security Checks	critical
330535	SUSE SLES16 Security Update : nginx (SUSE-SU-2026:22943-1)	Nessus	SuSE Local Security Checks	critical
330075	openSUSE 16 Security Update : nginx (openSUSE-SU-2026:21439-1)	Nessus	SuSE Local Security Checks	critical
327392	Amazon Linux 2023 : nginx, nginx-all-modules, nginx-core (ALAS2023-2026-1922)	Nessus	Amazon Linux Local Security Checks	critical
115285	Nginx < 1.30.3 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
115284	Nginx 1.31.x < 1.31.2 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
325580	Amazon Linux 2 : nginx, --advisory ALAS2NGINX1-2026-014 (ALASNGINX1-2026-014)	Nessus	Amazon Linux Local Security Checks	critical
325053	Debian dla-4667 : libnginx-mod-http-geoip - security update	Nessus	Debian Local Security Checks	critical
324046	Debian dla-4660 : libnginx-mod-http-auth-pam - security update	Nessus	Debian Local Security Checks	critical
323987	Debian dsa-6374 : libnginx-mod-http-geoip - security update	Nessus	Debian Local Security Checks	critical
323138	Fedora 43 : nginx / nginx-mod-brotli / nginx-mod-fancyindex / etc (2026-9d7328702e)	Nessus	Fedora Local Security Checks	critical
323136	Fedora 44 : nginx / nginx-mod-brotli / nginx-mod-fancyindex / etc (2026-b8e751787c)	Nessus	Fedora Local Security Checks	critical
322264	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : nginx vulnerabilities (USN-8458-1)	Nessus	Ubuntu Local Security Checks	critical
321915	nginx 0.3.50 < 1.30.3 / 1.31.x < 1.31.2 Buffer Overread in ngx_http_charset_module	Nessus	Web Servers	medium
321768	FreeBSD : nginx -- multiple vulnerabilities (46b654f8-6b28-11f1-b8e5-3497f65b111b)	Nessus	FreeBSD Local Security Checks	critical
321716	FreeBSD : nginx -- multiple vulnerabilities (08b0c0f6-6a85-11f1-b8e5-3497f65b111b)	Nessus	FreeBSD Local Security Checks	critical
321708	Linux Distros Unpatched Vulnerability : CVE-2026-48142	Nessus	Misc.	medium
321546	Fedora 45 : nginx / nginx-mod-brotli / nginx-mod-fancyindex / etc (2026-e212182e6e)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2026-48142

medium

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

medium

critical

critical

medium

critical