NGINX Plus CVE-2026-48142

Exploitation requires an NGINX location block explicitly configured with BOTH source_charset utf-8; AND a charset directive specifying a different target encoding (such as charset koi8-r;) simultaneously in the same block - this dual-directive combination is not present in default NGINX configurations and must be deliberately deployed. Beyond configuration, the CVE description states exploitation also depends on 'conditions beyond the attacker's control,' meaning specific content characteristics in the response body served or proxied through that location must be present at the time of the request; the attacker cannot independently guarantee these conditions from a remote position. What limits exploitation: the non-default dual-charset configuration is the primary gating factor, meaning the vast majority of NGINX deployments have zero exposure; the content-dependent triggering condition further reduces reliable exploitability; and the CVSS AC:H metric formalizes these stacked prerequisites. Impact is bounded to partial heap memory disclosure or a worker process restart, with no code execution or integrity impact.

The CVSS 4.8 score with vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L accurately characterizes a moderate, conditionally constrained risk. AC:H is well-justified by two stacked prerequisites: first, the target location block must be explicitly configured with both source_charset and a differing charset directive - not a default NGINX setting - and second, exploitation depends on content characteristics in the served or proxied response that the attacker cannot independently control. The limited impact metrics (C:L for partial heap memory leak, A:L for worker restart) confirm this is not a critical-severity issue. EPSS data was not provided in the available intelligence, preventing quantitative exploitation-probability assessment. No CISA KEV listing and no public POC indicate no confirmed active or mass exploitation at time of analysis. Real-world priority is low-to-moderate: organizations not using dual-charset configuration have zero exposure, while those using the feature should patch per the F5 advisory. The CVSS score does not conflict with the description - the AC:H metric correctly captures the dual-condition dependency described by the vendor.

An attacker identifies or infers an NGINX endpoint whose location block is configured with both source_charset utf-8 and a differing charset directive, then sends HTTP requests designed to elicit responses whose body content contains specific byte sequences that drive the charset conversion logic past the heap buffer boundary. Success additionally depends on the proxied or served content meeting specific structural conditions at the moment of request - a factor outside the attacker's direct control - meaning repeated requests against suitable endpoints increase the probability of triggering the over-read. A successful trigger either leaks a small quantity of adjacent heap memory from the NGINX worker (potentially exposing fragments of other in-flight request data) or causes the worker to crash and automatically restart, resulting in a brief disruption to request handling; no public POC exists at time of analysis.