CVE-2026-42946

A flaw was found in the ngx_http_scgi_module and ngx_http_uwsgi_module modules of NGINX. When scgi_pass or uwsgi_pass is configured, an unauthenticated attacker able to intercept and modify network traffic via a Man-In-The-Middle (MITM) attack and control the responses from an upstream server may be able to read sensitive data from the worker process or cause a denial of service by forcing the process to restart.

To exploit this issue, an attacker needs to be able to control the responses from SCGI or uWSGI backend servers via a Man-In-The-Middle (MITM) attack, limiting its exposure. Also, this vulnerability allows an attacker to read sensitive data from the memory of the worker process or cause a denial of service by forcing the process to restart, but it cannot cause a complete system denial of service. Due to these reasons, this flaw has been rated with a moderate severity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this flaw, ensure that the connection between NGINX and the backend SCGI/uWSGI servers is fully encrypted and authenticated, preventing the interception and manipulation of responses required to exploit this vulnerability.