CVE-2026-97629: NGINX Plus 37.1.0 to before 37.1.0.1, 37.0.0 to before 37.0.5.1, R36 to before *, R35 to before *, R34 to before *…

Affected technology

NGINX Plus · 37.1.0 to before 37.1.0.1, 37.0.0 to before 37.0.5.1, R36 to before *, R35 to before *, R34 to before *, R33 to before *
F5

NGINX Open Source · 1.31.0 to before 1.31.7, 1.30.0 to before 1.30.6, 1.23.3 to before *
F5

Component: ngx_http_ssl_module

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An attacker could leverage this vulnerability to bypass verification of client certificates. Vendor/CNA’s CVSS 4.0 assessment (base score 8.3/10) rates confidentiality impact as high; integrity impact as low; availability impact as none.