This vulnerability (CVE-2026-42934) involves an out-of-bounds read (CWE-125) in the ngx_http_charset_module of NGINX Plus and NGINX Open Source. When the charset-related directives and proxy_pass with buffering off are configured, crafted requests can trigger a heap buffer over-read in the worker process. This may result in limited disclosure of memory contents or cause the NGINX process to restart. The issue affects specific versions (R32, R36) and does not require authentication to exploit. The CVSS 3.1 base score is 4.8, indicating medium severity with network attack vector, high attack complexity, no privileges required, no user interaction, and limited confidentiality and availability impact.

Successful exploitation can lead to limited disclosure of memory contents or cause the NGINX worker process to restart, potentially disrupting service availability. There is no indication of integrity impact or privilege escalation. The vulnerability does not require authentication and can be triggered remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider avoiding configurations that combine charset, source_charset, charset_map directives with proxy_pass and disabled buffering. Monitor vendor communications for updates on patches or workarounds.