Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
nginx TLS Proxy Connection Data Injection Risk
published 7 months ago
Summary
nginx's TLS proxy connections can be exploited by a man-in-the-middle attack, allowing attackers to inject data into secure connections. This affects the security of sensitive data transmitted over these connections. Update to the latest version of nginx to mitigate this risk.
What to do
- Update almalinux nginx-all-modules to version 2:1.26.3-2.el10_1.
- Update almalinux nginx-filesystem to version 2:1.26.3-2.el10_1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:10 | almalinux | nginx-all-modules |
< 2:1.26.3-2.el10_1 Fix: upgrade to 2:1.26.3-2.el10_1
|
| AlmaLinux:10 | almalinux | nginx-filesystem |
< 2:1.26.3-2.el10_1 Fix: upgrade to 2:1.26.3-2.el10_1
|
Original advisory text
Moderate: nginx security update
nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.
Security Fix(es):
* nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections (CVE-2026-1642)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections (CVE-2026-1642)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://access.redhat.com/errata/RHSA-2026:4705 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-1642 Third Party Advisory
- https://bugzilla.redhat.com/2436738 Third Party Advisory
- https://errata.almalinux.org/10/ALSA-2026-4705.html Vendor Advisory
Timeline
Published17 Mar 2026
Updated26 May 2026
First seen26 May 2026
Sources
ALSA-2026:4705 · OSV
Track software like this
Free during beta