This vulnerability affects NGINX Open Source version 1.3.0 when used as a proxy to upstream TLS servers. It allows an attacker with a man-in-the-middle position on the upstream server side to inject plaintext data into the proxied server's response. The issue arises from acceptance of extraneous untrusted data combined with trusted data, classified under CWE-349. The vulnerability does not impact confidentiality but can affect data integrity by enabling injection of unauthorized content. The CVSS v3.1 base score is 5.9, reflecting a medium severity with network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. Versions that have reached End of Technical Support are not evaluated. There is no vendor advisory or patch information available at this time.

The vulnerability allows an attacker in a man-in-the-middle position on the upstream server side to inject unauthorized plaintext data into responses from proxied TLS servers. This compromises data integrity but does not affect confidentiality or availability. The attack complexity is high, and no known exploits are reported in the wild. The impact is limited to NGINX Open Source version 1.3.0 configured to proxy upstream TLS servers.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor F5's advisories for updates. Until a fix is available, consider reviewing proxy configurations and network security controls to limit man-in-the-middle opportunities on upstream connections.