nginx 1

CVE-2026-1642 is a race condition in how nginx processes upstream TLS connections. When nginx is configured as a reverse proxy to a TLS-backed upstream (HTTP/1.x, HTTP/2, gRPC, uWSGI), the event loop can process a READ event on the socket before the TLS handshake with the upstream completes. An attacker with a MITM position between nginx and its upstream server can flood the socket with plaintext HTTP during that narrow window; nginx will accept those bytes as if they came from the authenticated TLS peer. Affected: nginx 1.3.0 through 1.29.4 (both OSS and Plus). Fixed in 1.28.2 (stable) and 1.29.5 (mainline). The impact vector is VC:N/VI:H/VA:N — integrity only, no confidentiality or availability loss.

F5 rated this HIGH (CVSS v4.0 8.2) but the same vector maps to CVSS v3.1 5.9 (Medium) — a telling gap. The v4.0 score inflates because it doesn't fully weight the *upstream-side* MITM prerequisite. In practice, upstream traffic runs across a data-center fabric, VPC peering, service mesh, or private link — networks where an attacker with MITM capability already has far more damaging options (steal secrets, replace the backend outright, harvest tokens). Vendor severity is overstated for the typical enterprise deployment; MEDIUM is a truer read.

Why this verdict

• MITM position is the gate: the attacker must already sit between nginx and its upstream — a network position that, in modern datacenter and cloud fabrics, implies prior compromise of the east-west network. That single prerequisite cuts realistic exposure by orders of magnitude.
• Integrity-only impact: the bug is VI:H with VC:N and VA:N. No code execution, no credential theft, no data exfiltration primitive. The worst case is cache poisoning or WAF bypass — recoverable and detectable.
• Race window is narrow: exploitation requires winning a millisecond-scale race against the TLS Client Hello. TLS session resumption and any TLS-terminating middlebox in the upstream path shut the window entirely.
• Role multiplier — reverse proxy fronting backend services: nginx here is a canonical high-value role (traffic edge), but the chain fails when the upstream leg is a service mesh, private link, or same-host loopback. Even in a plausible worst-case (poison the cache of a customer-facing tenant), blast radius is bounded to that tenant's cached responses, not fleet-wide.
• No KEV, EPSS ~0.0001: F5 disclosed it responsibly, patch shipped same day, and six months later there is still no known weaponization.

Why not higher?

HIGH would require either a realistic remote-unauthenticated path (there is none — MITM on upstream is not that) or fleet-scale impact. Neither holds. The v4.0 8.2 score treats AT:P (attack requirements present) as a smaller discount than it deserves for this specific prerequisite class; v3.1's 5.9 MEDIUM is closer to operational reality.

Why not lower?

LOW would ignore that nginx is the most-deployed reverse proxy on earth and that shared-tenancy cloud, misconfigured service meshes, and flat east-west VLANs do exist. Where the MITM position is achievable, integrity compromise of the upstream response is a real cache-poisoning / WAF-bypass primitive. MEDIUM keeps it on the patch cycle without displacing genuinely urgent work.

1. Upgrade nginx to 1.28.2 or 1.29.5+ — This is the actual fix — schedule within the noisgate remediation SLA for MEDIUM (≤365 days), but prefer next standard maintenance window. Distro backports are shipped for Debian, Ubuntu, RHEL, Amazon Linux, Alpine.
2. Verify upstream traffic runs over private link, VPC peering, or a service mesh with mTLS — Eliminates the MITM prerequisite entirely. If your proxy_pass https://… targets are on the same VPC or reached via PrivateLink / Cloud Interconnect / a mesh sidecar, the exploitable surface collapses to zero.
3. Enable proxy_ssl_verify on with pinned upstream CA — Doesn't fix the race directly, but ensures the injected plaintext never gets promoted past the TLS layer on subsequent requests; also catches broader upstream tampering.
4. Disable proxy_cache on sensitive endpoints — Removes persistence for any injected response, cutting cache-poisoning impact even if the race is won for a single request.

Run on each host that runs nginx (as root or a user in the nginx group). Example: sudo bash check-nginx-1642.sh. Detects both OSS and NGINX Plus builds; parses nginx -v and compares to the fixed versions.

#!/usr/bin/env bash
# check-nginx-1642.sh — detect CVE-2026-1642 exposure
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN
set -u

NGINX_BIN="$(command -v nginx || true)"
if [ -z "$NGINX_BIN" ]; then
  echo "UNKNOWN: nginx not found in PATH"
  exit 2
fi

VER_RAW="$($NGINX_BIN -v 2>&1)"
# e.g. "nginx version: nginx/1.24.0" or "nginx/1.29.5 (nginx-plus-r33)"
VER="$(echo "$VER_RAW" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1)"
if [ -z "$VER" ]; then
  echo "UNKNOWN: could not parse version from: $VER_RAW"
  exit 2
fi

IFS=. read -r MAJ MIN PATCH <<<"$VER"

vuln=0
# Fixed: 1.28.2+ (stable) or 1.29.5+ (mainline). Anything else in 1.3.0..1.29.4 is vulnerable.
if [ "$MAJ" -eq 1 ]; then
  if [ "$MIN" -lt 3 ]; then
    vuln=0  # <1.3.0 not affected per advisory
  elif [ "$MIN" -lt 28 ]; then
    vuln=1
  elif [ "$MIN" -eq 28 ] && [ "$PATCH" -lt 2 ]; then
    vuln=1
  elif [ "$MIN" -eq 29 ] && [ "$PATCH" -lt 5 ]; then
    vuln=1
  fi
fi

# Check if proxy_pass https:// or grpcs:// is actually configured — the vuln path
CONF_DIR="/etc/nginx"
HAS_TLS_UPSTREAM=0
if [ -d "$CONF_DIR" ]; then
  if grep -REq 'proxy_pass[[:space:]]+https://|grpc_pass[[:space:]]+grpcs://|uwsgi_pass.*ssl' "$CONF_DIR" 2>/dev/null; then
    HAS_TLS_UPSTREAM=1
  fi
fi

if [ "$vuln" -eq 1 ]; then
  if [ "$HAS_TLS_UPSTREAM" -eq 1 ]; then
    echo "VULNERABLE: nginx $VER with TLS upstream configured (CVE-2026-1642)"
  else
    echo "VULNERABLE: nginx $VER (no TLS upstream currently configured — still upgrade)"
  fi
  exit 1
fi

echo "PATCHED: nginx $VER (>= 1.28.2 or >= 1.29.5)"
exit 0

Sources

1. Tenable Plugin 304671
2. oss-security disclosure (Jan Schaumann)
3. CVEReports technical analysis — race condition breakdown
4. nginx security advisories
5. Broadcom KB — CVE-2026-1642 impact assessment
6. kubernetes/ingress-nginx tracking issue #14528
7. docker-nginx-unprivileged release request