CVE-2026-48142 describes a heap buffer over-read in the ngx_http_charset_module of NGINX Open Source and NGINX Plus. The issue arises when a location block is configured with both source_charset set to utf-8 and a charset directive such as charset koi8-r. Under these conditions, remote unauthenticated attackers can send requests that cause the NGINX worker process to read beyond allocated heap memory, leading to limited disclosure of memory contents or a process restart. The vulnerability affects specific versions 1.13.10 and 1.30.0. No official remediation or patch is currently documented, and no known exploits are reported in the wild.

Successful exploitation can lead to limited disclosure of memory contents and potential denial of service via worker process restart. The impact on confidentiality is limited, with no integrity impact reported. Availability impact is low to medium due to possible process restarts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround has been documented at this time. Users should monitor vendor communications for updates and consider avoiding configurations that combine source_charset utf-8 with a charset directive until a fix is available.