The vulnerability originates in NGINX proxy logic that processes TLS upstream connections. When an attacker can sit in a man‑in‑the‑middle position on the upstream TLS server side, the proxy may mistakenly incorporate plain text data from the upstream server into the HTTP response that it forwards to downstream clients. This results in content tampering or unintended data disclosure, but does not grant the attacker code execution or broader system compromise. The flaw is classified as CWE‑345 and CWE‑349.

Affected products include F5’s NGINX Open Source distribution and all supported releases of F5 NGINX Plus that contain TLS proxy functionality, ranging from r32 to r36 as enumerated in the CPE list. End‑of‑support versions have not been evaluated for this issue.

The CVSS score of 8.2 marks the flaw as high severity, while an EPSS score of less than 1 % indicates a low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Successful exploitation requires an attacker to control the upstream TLS endpoint or otherwise achieve a MITM position, under conditions that are not trivially achievable.