CVE-2026-48142 NGINX ngx_http_charset_module vulnerability

🗓️ 17 Jun 2026 14:04:32Reported by f5Type

vulnrichment🔗 github.com👁 17 Views

NGINX charset module allows heap over-read via a location using utf-8 source and a charset directive

Reporter	Title	Published	Views	Family All 142
FreeBSD	nginx -- multiple vulnerabilities	17 Jun 202600:00	–	freebsd
FreeBSD	nginx -- multiple vulnerabilities	17 Jun 202600:00	–	freebsd
Tenable Nessus	Amazon Linux 2023 : nginx, nginx-all-modules, nginx-core (ALAS2023-2026-1922)	16 Jul 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2 : nginx, --advisory ALAS2NGINX1-2026-014 (ALASNGINX1-2026-014)	8 Jul 202600:00	–	nessus
Tenable Nessus	Debian dla-4660 : libnginx-mod-http-auth-pam - security update	1 Jul 202600:00	–	nessus
Tenable Nessus	Debian dla-4667 : libnginx-mod-http-geoip - security update	3 Jul 202600:00	–	nessus
Tenable Nessus	Debian dsa-6374 : libnginx-mod-http-geoip - security update	30 Jun 202600:00	–	nessus
Tenable Nessus	Fedora 43 : nginx / nginx-mod-brotli / nginx-mod-fancyindex / etc (2026-9d7328702e)	26 Jun 202600:00	–	nessus
Tenable Nessus	Fedora 44 : nginx / nginx-mod-brotli / nginx-mod-fancyindex / etc (2026-b8e751787c)	26 Jun 202600:00	–	nessus
Tenable Nessus	Fedora 45 : nginx / nginx-mod-brotli / nginx-mod-fancyindex / etc (2026-e212182e6e)	19 Jun 202600:00	–	nessus

Source	Link
my	www.my.f5.com/manage/s/article/K000161585

17 Jun 2026 14:04Current

5.6Medium risk

Vulners AI Score5.6

CVSS 3.14.8

CVSS 46.3

EPSS0.00684

SSVC

nginx charset module heap overread memory disclosure unauthenticated access