CVE-2026-48142

A flaw was found in NGINX. Remote, unauthenticated attackers can exploit a vulnerability in the ngx_http_charset_module when specific charset configurations are present. This can lead to a heap buffer over-read, potentially causing limited disclosure of memory or a denial of service by restarting the NGINX worker process.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, avoid configuring NGINX with both source_charset utf-8; and an additional charset directive within the same location block in the ngx_http_charset_module. If these directives are not essential for your NGINX deployment, removing one or both will prevent the vulnerability from being exploited. After modifying the NGINX configuration, reload the NGINX service using systemctl reload nginx. This action may temporarily interrupt active connections.