NGINX upstream TLS response injection (CVE-2026-1642)

Summary

An upstream man-in-the-middle attacker may inject plaintext into proxied responses.

Vulnerability ID	Vulnerability Overview
CVE-2026-1642	A flaw was found in NGINX OSS and NGINX Plus which could be triggered when configured to proxy to upstream Transport Layer Security (TLS) servers. This flaw allows an attacker with a man-in-the-middle (MITM) position on the upstream server side to inject plain text data into the response from an upstream proxied server.

Affected Supported TeraStations

TS5020/3030
- Fixed in firmware version 3.16

TS7010

 

Back to Security Notices

Date	Description
06/24/2026	Initial release
10/14/2026	Update

Back to Security Notices