Medium

Heap Buffer Over-read in NGINX ngx_http_charset_module

IdentifiersCVE-2026-48142CWE-125· Out-of-bounds Read

CVE-2026-48142 is a vulnerability in NGINX Open Source and NGINX Plus affecting ngx_http_charset_module. When content is served or proxied through a location configuration that enables both source_charset utf-8 and a charset conversion directive, processing of specially crafted UTF-8 data during charset conversion can trigger a heap buffer over-read in the NGINX worker process. Available reporting also describes the issue as occurring while decoding a crafted response body from UTF-8 through charset conversion logic associated with charset_map. The flaw is remotely reachable without authentication under affected configurations and can lead to limited disclosure of process memory or a worker process restart.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can cause a heap buffer over-read in an NGINX worker process. The primary security impact is limited disclosure of memory contents from the worker process address space. In some cases the fault may also terminate or restart the worker, causing a denial-of-service condition with degraded service reliability. The available information characterizes the disclosure as limited rather than a broad arbitrary read.

Mitigation

If you can’t patch tonight, do this now.

Until patches are applied, avoid or remove affected ngx_http_charset_module configurations in which a location simultaneously uses source_charset utf-8 and a charset conversion directive for served or proxied content. More generally, minimize use of charset conversion paths involving UTF-8 decoding through charset_map where not operationally necessary, and limit exposure of affected locations to untrusted remote clients where feasible.

Remediation

Patch, then assume compromise.

Upgrade NGINX Open Source or NGINX Plus to a vendor-fixed supported release that addresses CVE-2026-48142. If running a distribution-packaged build, apply the corresponding vendor security update for that package. Systems on releases that have reached End of Technical Support should be migrated to supported versions because unsupported versions are not evaluated for fixes. After patching, review charset conversion configurations in affected locations to ensure they are still required and correctly implemented.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

F5Dosapplication

F5Nginxapplication

F5Nginx Gateway Fabricapplication

F5Nginx Ingress Controllerapplication

F5Nginx Instance Managerapplication

F5Nginx Open Sourceapplication

F5Nginx Plusapplication

F5Wafapplication

NGINX, Inc.Nginxapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

15 SOURCESView more in app

thecyberexpress com vulnerabilitiesNews

Jul 20, 2026

CVE-2026-42533: Critical Pre-Auth Nginx RCE Flaw Found

Another vulnerability mentioned only in passing as a separate issue whose fixes do not cover CVE-2026-42533.

cyber security newsNews

Jul 20, 2026

15-Year-Old NGINX Vulnerability Lets Attackers Crash Workers and Achieve Remote Code Execution

Another nginx vulnerability mentioned only as background; fixes for it do not address CVE-2026-42533.

cyberveilleNews

Jul 20, 2026

CVE-2026-42533 : RCE critique pré-authentification dans nginx via heap overflow et fuite ASLR | CyberVeille

Another CVE mentioned only for comparison; its fixes do not address CVE-2026-42533.

egfincirt blogNews

Jun 21, 2026

F5 Security Updates - 21 June 2026 - EG-FinCIRT

An F5-addressed vulnerability affecting multiple F5/NGINX products; specific technical details are not provided in the content.

+4 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity4

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2026-48142

NVD

nvd.nist.gov/vuln/detail/CVE-2026-48142

MITRE CWE · CWE-125

Out-of-bounds Read

Vendor Advisory

my.f5.com/manage/s/article/K000161585

Heap Buffer Over-read in NGINX ngx_http_charset_module

IdentifiersCVE-2026-48142CWE-125· Out-of-bounds Read