Loading story…
F5 published security advisories for two NGINX mail-related vulnerabilities affecting the ngx_mail_auth_http_module and ngx_mail_smtp_module. The issues were assigned CVE-2026-27651 and CVE-2026-28753, respectively, and were disclosed through F5's product advisory channel for NGINX.
The advisories identify separate flaws in components used to support mail authentication over HTTP and SMTP handling within NGINX's mail functionality. While the published entries did not include public synopses, the disclosures indicate that organizations using NGINX mail modules should review the vendor advisories, determine whether the affected modules are enabled in their environments, and apply any recommended updates or mitigations from F5.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Microsoft added CVE-2026-27651 to its Security Update Guide as a vulnerability affecting the NGINX ngx_mail_auth_http_module. The reference provides no synopsis or further technical details beyond the advisory topic.
Microsoft added CVE-2026-28753 to its Security Update Guide as a vulnerability affecting the NGINX ngx_mail_proxy_module. The reference provides no synopsis or further technical details beyond the advisory topic.
F5 published a product advisory for a vulnerability in the NGINX ngx_mail_smtp_module, tracked as CVE-2026-28753. The reference does not include further synopsis or impact details.
F5 published a product advisory for a vulnerability in the NGINX ngx_mail_auth_http_module, tracked as CVE-2026-27651. The reference provides no additional synopsis or technical details beyond the advisory topic.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemy.f5.com
Open sourcemy.f5.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
F5 disclosed multiple high-severity vulnerabilities affecting **NGINX Open Source**, **NGINX Plus**, and related products, including a critical heap-based buffer overflow in `ngx_http_proxy_v2_module` and `ngx_http_grpc_module` tracked as **CVE-2026-42055**. The flaw can be triggered remotely without authentication when HTTP/2 proxying or `grpc_pass` is enabled, `ignore_invalid_headers` is set to `off`, and `large_client_header_buffers` exceeds 2 MB, allowing oversized headers to crash worker processes and potentially enable code execution if ASLR is bypassed. F5 also disclosed **CVE-2026-42530**, a critical use-after-free in the open-source `ngx_http_v3_module` that can be exploited through a crafted HTTP/3 QUIC session to reopen a QPACK encoder stream, again causing worker restarts and possible code execution. A separate issue, **CVE-2026-11311**, affects **NGINX Gateway Fabric** when **NGINX Plus** is used as the data plane, allowing authenticated users with permission to modify relevant CRDs to inject arbitrary NGINX directives through unsanitized values in `NginxProxy.serverTokens` and `AuthenticationFilter.extraAuthArgs`. F5's out-of-band advisory said the exposure spans a broad set of products, including **NGINX Ingress Controller**, **NGINX Instance Manager**, **NGINX App Protect WAF**, **NGINX App Protect DoS**, **F5 WAF for NGINX Instance Manager**, and **F5 DoS for NGINX**. Updated releases, including **nginx 1.31.2** and the stable branch **1.30.3**, were published to address the core NGINX flaws, and defenders were urged to patch affected versions or disable HTTP/3 QUIC where immediate updates are not possible.
Jun 29, 2026
F5 disclosed and patched multiple NGINX vulnerabilities, including the high-severity `CVE-2026-32647` in `ngx_http_mp4_module`, which affects both **NGINX Open Source** and **NGINX Plus**. The flaw is an out-of-bounds read memory corruption issue triggered when NGINX processes a specially crafted MP4 file, allowing a local authenticated attacker to crash worker processes in the data plane and potentially achieve arbitrary code execution. F5 said the control plane is not affected and credited Xint Code and Pavel Kohout of Aisle Research with the discovery and coordinated disclosure. The vulnerable condition impacts deployments using the `mp4` directive with `ngx_http_mp4_module` enabled; the module is included by default in NGINX Plus, while NGINX Open Source requires it to be explicitly compiled and enabled. F5 also published advisories for `CVE-2026-27654` in `ngx_http_dav_module` and `CVE-2026-28755` in `ngx_stream_ssl_module`, indicating a broader set of NGINX fixes released together. The company issued patched versions for affected NGINX Plus and Open Source releases and advised organizations that cannot patch immediately to disable the MP4 module and limit media publishing to trusted users.
Jun 29, 2026
Microsoft published security advisories for two NGINX vulnerabilities tracked as **`CVE-2026-28755`** and **`CVE-2026-27784`**. The flaws affect the **`ngx_stream_ssl_module`** and **`ngx_http_mp4_module`** components, respectively, and were listed in the Microsoft Security Update Guide as NGINX-related issues. The advisories provide limited public detail, with no synopsis included in the referenced entries, but they identify separate weaknesses in two widely used NGINX modules tied to SSL/TLS stream handling and MP4 content processing. Organizations using NGINX in Microsoft-supported environments should review the corresponding CVE entries and assess exposure in deployments where either module is enabled.
Jul 3, 2026