CVE-2026-48142 is an out-of-bounds read vulnerability (CWE-125) in the ngx_http_charset_module of F5 NGINX Open Source. It occurs when content is served or proxied through a location block configured with both source_charset utf-8 and a charset directive such as charset koi8-r. Under these conditions, remote unauthenticated attackers can send crafted requests that cause a heap buffer over-read in the NGINX worker process. This can result in limited disclosure of memory contents or cause the worker process to restart. The vulnerability affects versions from 1.13.10 up to and including 1.30.0. The vulnerability has a CVSS 3.1 base score of 4.8 (medium severity) with network attack vector, high attack complexity, no privileges required, no user interaction, and limited confidentiality and availability impact. No known exploits in the wild or official remediation are currently documented.

Successful exploitation can cause limited disclosure of memory contents or a restart of the NGINX worker process, potentially impacting service availability and confidentiality of some memory data. The attack requires network access but has high complexity and no privileges or user interaction. The impact is limited to confidentiality and availability with no integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround is currently documented. Users should monitor F5's advisories for updates. Until a patch is available, consider avoiding configurations that combine source_charset utf-8 with a charset directive in the ngx_http_charset_module if feasible.