NGINX Plus and NGINX Open Source CVE-2026-42934

The vulnerability is ONLY exploitable when ALL four conditions are simultaneously true: (1) ngx_http_charset_module is enabled with charset and source_charset directives configured, (2) charset_map directive is defined to specify character set mappings, (3) proxy_pass directive is configured with buffering explicitly disabled ('off' parameter), and (4) an attacker sends requests that trigger the buffer over-read condition-this final condition depends on factors beyond attacker control (timing, request content format, upstream response characteristics), which is why CVSS Attack Complexity is High. Exploitation is limited to NGINX instances with this specific multi-directive configuration; default NGINX configurations (which do not use charset transformations) are not vulnerable. The vulnerability cannot be exploited against NGINX deployments that use proxy_buffering in its default state (enabled) or that do not configure charset_map directives.

This vulnerability presents moderate real-world risk constrained by multiple exploit prerequisites. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U) indicates network accessibility and no authentication required, but AC:H (Attack Complexity: High) signals that successful exploitation depends on conditions beyond attacker control-specifically the interaction between the four configuration directives and the timing/content of requests. EPSS data is not provided, limiting probabilistic exploitation assessment. The absence of a KEV (Known Exploited Vulnerability) listing suggests no confirmed active exploitation at analysis time, and no public proof-of-concept is referenced. The impact is constrained to information disclosure (C:L) and limited availability (A:L), excluding integrity impact. The real priority for defenders depends on deployment configuration: organizations using all four required directives (charset + source_charset + charset_map + proxy_pass with buffering=off) face meaningful risk; those using fewer directives are not affected. The vendor-released patch confirms this is not an unfixable architectural flaw. This is a genuine but narrowly-scoped vulnerability-not a blanket NGINX risk despite the product prominence.

An unauthenticated attacker sends a series of HTTP requests to a NGINX instance configured with charset transformation and non-buffered proxy pass. The attacker crafts requests with specific character encoding sequences that trigger the heap buffer over-read in the charset conversion logic. If conditions align (the exact timing and content conditions are outside attacker control per CVSS AC:H), the worker process reads adjacent heap memory and either returns it in the response (information disclosure) or crashes, triggering denial of service through worker restart.