[Bug] [Security] SafeLine CE v9.4.1 May Be Affected by CVE-2026-1642 – Please Confirm Tengine/NGINX Patch Status

SafeLine version

9.4.1

Bug description

Description

Hello SafeLine team,

I am currently using SafeLine CE v9.4.1.

During a recent security review, I noticed that the Tengine/NGINX component used by SafeLine may potentially be affected by CVE-2026-1642 (NGINX SSL upstream injection).

I have not performed an actual vulnerability exploitation test, so I am not claiming that SafeLine v9.4.1 is definitely vulnerable.

The purpose of this issue is to ask the SafeLine team to confirm whether the Tengine/NGINX version included in SafeLine v9.4.1 already contains the upstream fix or an equivalent backported patch.

---

Environment

• Product: SafeLine CE
• Version: v9.4.1
• Component: SafeLine Tengine / NGINX
• CVE: CVE-2026-1642
• Vulnerability: NGINX SSL upstream injection

---

CVE Information

According to the NGINX Security Advisories and NVD information, CVE-2026-1642 affects the handling of HTTPS/TLS upstream connections in NGINX.

Under specific conditions, if an attacker is able to position themselves between NGINX/WAF and the HTTPS upstream server, it may be possible to inject a plaintext response before the TLS handshake has been fully established, potentially affecting the integrity of the proxied response.

The affected versions published by NGINX are:

Affected

NGINX OSS 1.3.0 - 1.29.4

Fixed

NGINX 1.28.2+
NGINX 1.29.5+

---

Preliminary Local Investigation

After reviewing the upstream fix for CVE-2026-1642, I noticed that the patch introduced additional upstream state validation and included the following error message:

upstream prematurely sent response

I therefore performed a simple static string check against the NGINX/Tengine binary in my current SafeLine environment:

grep -aF "upstream prematurely sent response" "$(command -v nginx)"

No matching string was found in my current environment.

---

Current Assessment

I would like to emphasize that:

The absence of this string does not prove that SafeLine v9.4.1 is vulnerable to CVE-2026-1642.

There may be several explanations:

1. SafeLine may already include a backported fix for CVE-2026-1642.
2. SafeLine may use an equivalent fix implemented differently.
3. The bundled Tengine/NGINX code may differ from upstream NGINX.
4. SafeLine's generated configuration or runtime behavior may not satisfy the conditions required to trigger this vulnerability.

Therefore, my current assessment is only:

The CVE-2026-1642 patch status in SafeLine CE v9.4.1 cannot currently be confirmed from publicly available information or this simple static check.

No destructive testing or active exploitation has been performed.

---

Questions for the SafeLine Team

Could you please help confirm the following?

1. What exact Tengine/NGINX version and source code baseline are used in SafeLine CE v9.4.1?

2. Does SafeLine v9.4.1 already include the upstream fix for CVE-2026-1642, or an equivalent backported patch?

3. If the patch is not currently included, can SafeLine's default HTTPS upstream configuration satisfy the conditions required to trigger CVE-2026-1642?

4. If SafeLine is affected, is there a plan to:

   • backport the security patch,
   • upgrade Tengine/NGINX,
   • or release the fix in a future SafeLine version?

5. If this issue has already been fixed, could you provide the corresponding patch, commit, SafeLine version, or security advisory so users can verify their deployment status?

---

References

• NGINX Security Advisories https://nginx.org/en/security_advisories.html

• NVD – CVE-2026-1642 https://nvd.nist.gov/vuln/detail/CVE-2026-1642

---

Thank you for looking into this.

If additional information is required, I can provide:

nginx -v
nginx -V

as well as the relevant SafeLine/Tengine container version information and the results of my local static checks.

For security reasons, I can provide more detailed environmental information or further test results if needed.