Loading story…
F5 disclosed and patched multiple NGINX vulnerabilities, including the high-severity CVE-2026-32647 in ngx_http_mp4_module, which affects both NGINX Open Source and NGINX Plus. The flaw is an out-of-bounds read memory corruption issue triggered when NGINX processes a specially crafted MP4 file, allowing a local authenticated attacker to crash worker processes in the data plane and potentially achieve arbitrary code execution. F5 said the control plane is not affected and credited Xint Code and Pavel Kohout of Aisle Research with the discovery and coordinated disclosure.
The vulnerable condition impacts deployments using the mp4 directive with ngx_http_mp4_module enabled; the module is included by default in NGINX Plus, while NGINX Open Source requires it to be explicitly compiled and enabled. F5 also published advisories for CVE-2026-27654 in ngx_http_dav_module and CVE-2026-28755 in ngx_stream_ssl_module, indicating a broader set of NGINX fixes released together. The company issued patched versions for affected NGINX Plus and Open Source releases and advised organizations that cannot patch immediately to disable the MP4 module and limit media publishing to trusted users.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On 2026-03-24, F5 published an advisory for CVE-2026-28755 affecting the NGINX ngx_stream_ssl_module. The reference content identifies this as a separate vulnerability disclosure by F5.
On 2026-03-24, F5 published an advisory for CVE-2026-27654 affecting the NGINX ngx_http_dav_module. The reference content identifies this as a distinct vulnerability disclosure by F5.
On 2026-03-24, F5 published an advisory for CVE-2026-32647, a high-severity out-of-bounds read in ngx_http_mp4_module that can cause denial of service and potentially arbitrary code execution when processing a crafted MP4 file. F5 released patches for affected NGINX Plus and NGINX Open Source versions and noted the issue was discovered and coordinatedly disclosed by Xint Code and Pavel Kohout of Aisle Research.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcemy.f5.com
Open sourcemy.f5.com
Open sourcemy.f5.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
F5 disclosed multiple high-severity vulnerabilities affecting **NGINX Open Source**, **NGINX Plus**, and related products, including a critical heap-based buffer overflow in `ngx_http_proxy_v2_module` and `ngx_http_grpc_module` tracked as **CVE-2026-42055**. The flaw can be triggered remotely without authentication when HTTP/2 proxying or `grpc_pass` is enabled, `ignore_invalid_headers` is set to `off`, and `large_client_header_buffers` exceeds 2 MB, allowing oversized headers to crash worker processes and potentially enable code execution if ASLR is bypassed. F5 also disclosed **CVE-2026-42530**, a critical use-after-free in the open-source `ngx_http_v3_module` that can be exploited through a crafted HTTP/3 QUIC session to reopen a QPACK encoder stream, again causing worker restarts and possible code execution. A separate issue, **CVE-2026-11311**, affects **NGINX Gateway Fabric** when **NGINX Plus** is used as the data plane, allowing authenticated users with permission to modify relevant CRDs to inject arbitrary NGINX directives through unsanitized values in `NginxProxy.serverTokens` and `AuthenticationFilter.extraAuthArgs`. F5's out-of-band advisory said the exposure spans a broad set of products, including **NGINX Ingress Controller**, **NGINX Instance Manager**, **NGINX App Protect WAF**, **NGINX App Protect DoS**, **F5 WAF for NGINX Instance Manager**, and **F5 DoS for NGINX**. Updated releases, including **nginx 1.31.2** and the stable branch **1.30.3**, were published to address the core NGINX flaws, and defenders were urged to patch affected versions or disable HTTP/3 QUIC where immediate updates are not possible.
Jun 29, 2026
Microsoft published security advisories for two NGINX vulnerabilities tracked as **`CVE-2026-28755`** and **`CVE-2026-27784`**. The flaws affect the **`ngx_stream_ssl_module`** and **`ngx_http_mp4_module`** components, respectively, and were listed in the Microsoft Security Update Guide as NGINX-related issues. The advisories provide limited public detail, with no synopsis included in the referenced entries, but they identify separate weaknesses in two widely used NGINX modules tied to SSL/TLS stream handling and MP4 content processing. Organizations using NGINX in Microsoft-supported environments should review the corresponding CVE entries and assess exposure in deployments where either module is enabled.
Jul 3, 2026
F5 published security advisories for two **NGINX mail-related vulnerabilities** affecting the `ngx_mail_auth_http_module` and `ngx_mail_smtp_module`. The issues were assigned **`CVE-2026-27651`** and **`CVE-2026-28753`**, respectively, and were disclosed through F5's product advisory channel for NGINX. The advisories identify separate flaws in components used to support mail authentication over HTTP and SMTP handling within NGINX's mail functionality. While the published entries did not include public synopses, the disclosures indicate that organizations using NGINX mail modules should review the vendor advisories, determine whether the affected modules are enabled in their environments, and apply any recommended updates or mitigations from F5.
Jun 29, 2026