[Bug] [Security] SafeLine CE v9.4.1 May Be Affected by CVE-2026-1642 – Please Confirm Tengine/NGINX Patch Status

SafeLine version

9.4.1

Bug description

Description

Hello SafeLine team,

I am currently using SafeLine CE v9.4.1.

During a recent security review, I noticed that the Tengine/NGINX component used by SafeLine may potentially be affected by CVE-2026-1642 (NGINX SSL upstream injection).

I have not performed an actual vulnerability exploitation test, so I am not claiming that SafeLine v9.4.1 is definitely vulnerable.

The purpose of this issue is to ask the SafeLine team to confirm whether the Tengine/NGINX version included in SafeLine v9.4.1 already contains the upstream fix or an equivalent backported patch.

Environment

• Product: SafeLine CE
• Version: v9.4.1
• Component: SafeLine Tengine / NGINX
• CVE: CVE-2026-1642
• Vulnerability: NGINX SSL upstream injection

CVE Information

According to the NGINX Security Advisories and NVD information, CVE-2026-1642 affects the handling of HTTPS/TLS upstream connections in NGINX.

Under specific conditions, if an attacker is able to position themselves between NGINX/WAF and the HTTPS upstream server, it may be possible to inject a plaintext response before the TLS handshake has been fully established, potentially affecting the integrity of the proxied response.

The affected versions published by NGINX are:

Affected

1NGINX OSS 1.3.0 - 1.29.4

Fixed

1NGINX 1.28.2+
2NGINX 1.29.5+

Preliminary Local Investigation

After reviewing the upstream fix for CVE-2026-1642, I noticed that the patch introduced additional upstream state validation and included the following error message:

1upstream prematurely sent response

I therefore performed a simple static string check against the NGINX/Tengine binary in my current SafeLine environment:

1grep -aF "upstream prematurely sent response" "$(command -v nginx)"

No matching string was found in my current environment.

Current Assessment

I would like to emphasize that:

The absence of this string does not prove that SafeLine v9.4.1 is vulnerable to CVE-2026-1642.

There may be several explanations:

1. SafeLine may already include a backported fix for CVE-2026-1642.
2. SafeLine may use an equivalent fix implemented differently.
3. The bundled Tengine/NGINX code may differ from upstream NGINX.
4. SafeLine's generated configuration or runtime behavior may not satisfy the conditions required to trigger this vulnerability.

Therefore, my current assessment is only:

The CVE-2026-1642 patch status in SafeLine CE v9.4.1 cannot currently be confirmed from publicly available information or this simple static check.

No destructive testing or active exploitation has been performed.

Questions for the SafeLine Team

Could you please help confirm the following?

1. What exact Tengine/NGINX version and source code baseline are used in SafeLine CE v9.4.1?

2. Does SafeLine v9.4.1 already include the upstream fix for CVE-2026-1642, or an equivalent backported patch?

3. If the patch is not currently included, can SafeLine's default HTTPS upstream configuration satisfy the conditions required to trigger CVE-2026-1642?

4. If SafeLine is affected, is there a plan to:

   • backport the security patch,
   • upgrade Tengine/NGINX,
   • or release the fix in a future SafeLine version?

5. If this issue has already been fixed, could you provide the corresponding patch, commit, SafeLine version, or security advisory so users can verify their deployment status?

References

• NGINX Security Advisories
  https://nginx.org/en/security_advisories.html

• NVD – CVE-2026-1642
  https://nvd.nist.gov/vuln/detail/CVE-2026-1642

Thank you for looking into this.

If additional information is required, I can provide:

1nginx -v
2nginx -V

as well as the relevant SafeLine/Tengine container version information and the results of my local static checks.

For security reasons, I can provide more detailed environmental information or further test results if needed.

Additional environment information from the affected SafeLine CE v9.4.1 deployment:

1$ nginx -v
2nginx t1k version: 4.3.0

The bundled binary therefore uses SafeLine/Chaitin's own t1k versioning rather than the standard upstream NGINX version numbering.

Because of this, I cannot reliably determine the underlying NGINX/Tengine source baseline from the reported version number alone.

I also checked the binary for the diagnostic string introduced by the upstream CVE-2026-1642 fix:

1grep -aF "upstream prematurely sent response" "$(command -v nginx)"

Result:

1No matching string found.

Again, this does not prove that the bundled Tengine/NGINX is vulnerable, since SafeLine may use an equivalent or differently implemented backport.

I would mainly like to confirm whether nginx t1k version: 4.3.0 contains the upstream CVE-2026-1642 fix or an equivalent mitigation.

Hello @musicclub1563,

Thank you for the detailed report. We also appreciate that you clearly stated the scope and limitations of the static analysis results in your report. This was very helpful for our investigation and verification.

We have completed our internal investigation and confirmed the following:

Version Information
SafeLine CE v9.4.1 uses a Tengine build that is maintained by our team.

Patch Status
We have confirmed that this build does not include the official fix for CVE-2026-1642, nor have we identified an equivalent fix implemented in another way. The results of your static string analysis are consistent with our findings.

Affected Conditions
The issue can only be triggered under specific conditions: the SafeLine upstream must be configured as an HTTPS (TLS) upstream, and an attacker must be able to perform a man-in-the-middle attack between SafeLine and the upstream server. The additional timing conditions described in the security advisory must also be met.

SafeLine's TLS termination for client-side connections is not affected by this issue. Deployments using HTTP upstreams, or deployments without an upstream configured, do not meet the conditions required to trigger the issue.

Next Steps
We will prioritize addressing this issue and release a fix as soon as possible. Once the fix is available, we will update this Issue with the relevant information.

Thank you again for your detailed report and for helping us improve SafeLine.

Dear Safeline Team! Can you advise when the fix is expected? Also are there any interim recommendations?

Dear Safeline Team! Can you advise when the fix is expected? Also are there any interim recommendations?

Hi, the fix is planned for v9.4.3. We’ll keep you updated and let you know once the new version is released.