CVE-2026-42934: NGINX ngx_http_charset_module vulnerability
Last updated 6 June 2026
Other sources
NGINX ngxhttpcharsetmodule vulnerability
— Microsoft
NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpcharsetmodule module. When charset, sourcecharset, and charsetmap and proxypass with disabled buffering ("off") directives are configured, unauthenticated attackers can send requests that with conditions beyond the attackers' control to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/nginxto a version that resolves this vulnerability.Fixed in 1.18.0-6.1+deb11u6Fixed in 1.22.1-9+deb12u7Fixed in 1.26.3-3+deb13u5Fixed in 1.30.1-3 - Upgrade
Upgrade
debian/nginxto a version that resolves this vulnerability.Fixed in 1.18.0-6.1+deb11u6 - Upgrade
Upgrade
debian/nginxto a version that resolves this vulnerability.Fixed in 1.22.1-9+deb12u7 - Upgrade
Upgrade
debian/nginxto a version that resolves this vulnerability.Fixed in 1.26.3-3+deb13u5 - Upgrade
Upgrade
debian/nginxto a version that resolves this vulnerability.Fixed in 1.30.1-3 - Configuration
Ensure proxy_buffering is enabled (not set to 'off') for any location using proxy_pass when charset, source_charset, or charset_map are configured to avoid the vulnerable condition described.
NGINX (ngx_http_charset_module) proxy_buffering = on - Configuration
Disable charset (use 'charset off') in http/server/location blocks that use proxy_pass with proxy_buffering set to 'off', or otherwise avoid configuring charset when proxy_buffering is disabled.
NGINX (ngx_http_charset_module) charset = off - Configuration
Remove or do not configure source_charset and charset_map in any blocks that use proxy_pass with proxy_buffering set to 'off' to avoid the condition that can lead to a heap buffer over-read.
NGINX (ngx_http_charset_module) source_charset and charset_map = remove/unset
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42934?
CVE-2026-42934 is rated as a medium severity vulnerability due to the potential for unauthenticated attacks.
How do I fix CVE-2026-42934?
To fix CVE-2026-42934, you should update to the latest version of NGINX Plus or NGINX Open Source that addresses this vulnerability.
What products are affected by CVE-2026-42934?
CVE-2026-42934 affects both NGINX Plus and NGINX Open Source installations.
What are the attack vectors for CVE-2026-42934?
The attack vector for CVE-2026-42934 involves sending specially crafted requests to NGINX instances with specific charset configurations.
Can CVE-2026-42934 be exploited remotely?
Yes, CVE-2026-42934 can be exploited remotely by unauthenticated attackers under the right conditions.