This vulnerability (CVE-2026-42934) involves an out-of-bounds read (CWE-125) in the ngx_http_charset_module of NGINX Plus and NGINX Open Source. Under certain configurations involving charset, source_charset, charset_map, and proxy_pass with buffering disabled, unauthenticated attackers can send crafted requests that trigger a heap buffer over-read in the NGINX worker process. This can result in limited disclosure of memory contents or cause the worker process to restart. The issue affects versions R32 and R36 of NGINX Plus. The vulnerability has a CVSS 3.1 base score of 4.8, indicating medium severity. No known exploits are reported in the wild, and no official patch or remediation level has been announced.

Successful exploitation can lead to limited disclosure of memory contents or cause the NGINX worker process to restart, potentially impacting availability. There is no indication of privilege escalation or integrity compromise. The vulnerability can be triggered by unauthenticated remote attackers under specific configuration conditions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review configurations involving charset, source_charset, charset_map, and proxy_pass with buffering disabled to assess exposure. Consider avoiding or modifying these configurations if feasible to reduce risk.