CVE-2026-42946: NGINX ngx_http_scgi_module and ngx_http_uwsgi_module vulnerability
F5 · NGINX Plus
Vendor fix available · Affected: F5 NGINX Plus · Exploitation: unlikely (under 1%)
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 61% of scored CVEs
DescriptionCVE.org
A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data. When scgi_pass or uwsgi_pass is configured, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to read the memory of the NGINX worker process or restart it. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected products2
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- F5 · NGINX Plusfrom R36 before R36 P4; from R32 before R32 P6
- F5 · NGINX Open Sourcefrom 0.8.42 before 1.30.1
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
CoverageNo articles yet
No CyberSIXT article names CVE-2026-42946 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.