Man-in-the-Middle Vulnerability in NGINX Proxying TLS Servers

CVE-2026-1642

What is CVE-2026-1642?

A security flaw has been identified in NGINX OSS and NGINX Plus when these products are configured to proxy connections to upstream Transport Layer Security (TLS) servers. An attacker in a man-in-the-middle position on the upstream server could potentially interfere with the communication flow, allowing them to inject plain text data into the responses from proxied upstream servers. This vulnerability highlights the importance of robust security measures in proxy configurations to prevent unauthorized access and ensure data integrity.

References