CVE-2026-42946highCWE-789CWE-823

CVE-2026-42946: high-severity vulnerability in F5 NGINX Open Source

NGINX ngx_http_scgi_module and ngx_http_uwsgi_module vulnerability

Published

Follow this CVE+ Monitor NGINX Plus+ Monitor NGINX Open Source

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.3epss 0.9%
In short

NGINX's SCGI and UWSGI modules have a flaw that allows an attacker positioned between NGINX and its backend server to read worker memory or crash NGINX by sending malicious responses. This affects servers using these modules without proper protection.

Technical detail

The vulnerability exists in ngx_http_scgi_module and ngx_http_uwsgi_module, allowing an unauthenticated MITM attacker to trigger excessive memory allocation (CWE-789) or out-of-bounds reads (CWE-823) via crafted upstream responses when scgi_pass or uwsgi_pass directives are configured. Successful exploitation can lead to information disclosure from worker process memory or denial of service through process restart.

Summary generated and translated by AI from the official description.
A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data. When scgi_pass or uwsgi_pass is configured, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to read the memory of the NGINX worker process or restart it.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N
Affected products
F5 · NGINX Open SourceF5 · NGINX Plus
Related CVEs — F5 NGINX Open Source

In the same product, most dangerous first.

CVE-2026-42945CRITICALNGINX ngx_http_rewrite_module vulnerabilityEPSS 68.0%CVE-2026-27654HIGHNGINX ngx_http_dav_module vulnerabilityEPSS 25.9%CVE-2026-9256CRITICALNGINX ngx_http_rewrite_module vulnerabilityEPSS 10.9%CVE-2026-42055CRITICALNGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerabilityEPSS 6.5%CVE-2026-42533CRITICALNGINX Map directive and Regex matching vulnerabilityEPSS 6.3%CVE-2026-42530CRITICALNGINX Open-Source ngx_http_v3_module vulnerabilityEPSS 6.2%