This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] F5 NGINX fixes 6 vulnerabilities

F5 fixes 6 vulnerabilities in NGINX Plus and NGINX Open Source. The most severe of them are described below; the remaining ones can be found at [1]. Fixed versions of the individual products: NGINX Plus - R36 P3, R35 P2, R32 P5 NGINX Open Source - 1.29.7, 1.28.3

NGINX Plus, NGINX Open Source - DoS, file name modification (CVE-2026-27654)
CVSS 8.8 (High)

Allows an unauthenticated remote attacker, due to a buffer overflow in the WebDAV module (ngx_http_dav_module), to carry out a DoS attack on NGINX or modify the names of files accessible to the NGINX worker process by sending a specially crafted string. Configurations with the DAV module enabled with the MOVE or COPY methods, using a location prefix and the alias directive, are vulnerable. Detailed information, including instructions for temporary mitigation, can be found at [2].

The vulnerability is present in products:

  • NGINX Plus; >=R32, <R32 P5; >=R33, <R35 P2; >=R36, <R36 P3;
  • NGINX Open Source; >=0.5.13, <=0.9.7; >=1.0.0, <1.28.3; >=1.29, <1.29.7;

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

More information:

The vulnerability was publicly disclosed 24. 3. 2026.

NGINX Plus, NGINX Open Source - DoS (CVE-2026-27651)
CVSS 8.7 (High)

Allows an unauthenticated remote attacker, under certain conditions, to carry out a DoS attack on instances with the ngx_mail_auth_http_module module enabled. The system is vulnerable if it uses CRAM-MD5 or APOP as authentication methods and if the authentication server allows request retries via the Auth-Wait header [3].

The vulnerability is present in products:

  • NGINX Plus; >=R32, <R32 P5; >=R33, <R35 P2; >=R36, <R36 P3;
  • NGINX Open Source; >=0.5.15, <=0.9.7; >=1.0.0, <1.28.3; >=1.29, <1.29.7;

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

More information:

The vulnerability was publicly disclosed 24. 3. 2026.

NGINX Plus, NGINX Open Source - DoS, RCE (CVE-2026-32647)
CVSS 8.5 (High)

Allows an authenticated local attacker, using a specially crafted MP4 file and under certain conditions, to carry out a DoS attack on an NGINX system with the ngx_http_mp4_module module enabled or potentially execute code. Only instances that have the mp4 directive active in their configuration and where the attacker can force the file to be processed are vulnerable [4]. A similar vulnerability (CVE-2026-27784) specifically affects 32-bit builds of NGINX Open Source [5]. Detailed information, including instructions for temporary mitigation, can be found at [4][5].

The vulnerability is present in products:

  • NGINX Plus; >=R32, <R32 P5; >=R33, <R35 P2; >=R36, <R36 P3;
  • NGINX Open Source; >=1.1.19, <1.28.3; >=1.29, <1.29.7;

CVSS: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

More information:

The vulnerability was publicly disclosed 24. 3. 2026.

By CESNET, z.s.p.o. Michaela Ručková on 1. 4. 2026.

CESNET, z.s.p.o. Logo