F5 has disclosed a high-severity vulnerability (CVE-2026-32647) in the NGINX ngx_http_mp4_module that allows attackers execute arbitrary code or cause a denial-of-service (DoS) using crafted MP4 files.
This flaw impacts NGINX Plus and NGINX Open Source deployments where the MP4 streaming module is explicitly enabled in the server configuration.
The security flaw, tracked as CVE-2026-32647, is classified under CWE-125 as an out-of-bounds read.
It carries a CVSS v4.0 score of 8.5 and a CVSS v3.1 score of 7.8, reflecting its high severity.
The issue resides entirely in the data plane and requires a local, authenticated attacker to upload or trigger the processing of a maliciously crafted MP4 file.
When the NGINX worker memory processes this crafted file, it can trigger a buffer over-read or over-write.
This memory corruption forces the NGINX worker process to restart, temporarily dropping traffic and causing a DoS condition.
Under specific conditions, this memory corruption could also be weaponized to achieve remote code execution on the host server.
Fortunately, the MP4 module is not active by default in NGINX Open Source, meaning only administrators who explicitly added the mp4 directive to their configuration files are exposed.
Affected Products and Fixes
F5 has confirmed that this vulnerability impacts multiple versions of its web server software and has released official patches to address the issue.
For NGINX Plus, the flaw affects the R3x branch, specifically from versions R32 through R36.
Administrators using NGINX Plus must upgrade to versions R36 P3, R35 P2, or R32 P5 to secure their environments against this threat.
For NGINX Open Source, the vulnerability impacts the 1.x branch spanning versions 1.1.19 through 1.29.6.
The development team has introduced fixes in NGINX Open Source versions 1.29.7 and 1.28.3.
Other F5 products, including BIG-IP Next, BIG-IQ Centralized Management, F5OS, and F5 Distributed Cloud Services, have been evaluated and are not vulnerable to this specific MP4 module flaw.
Security researchers Xint Code and Pavel Kohout from Aisle Research are credited with responsibly disclosing this vulnerability to F5.
Administrators who cannot immediately apply the official software updates can implement temporary workarounds to mitigate the risk.
The primary mitigation strategy is to strictly limit the publishing of audio and video files to trusted users only.
Alternatively, organizations can completely disable the MP4 pseudo-streaming support by commenting out the mp4 directives in their NGINX configuration files, which are usually located in the /etc/nginx directory.
By adding a hash character (#) before any mp4 directives in the http, server, or location contexts, the module is neutralized.
After saving these changes, administrators should verify the syntax using the sudo nginx -t command and safely apply the update by reloading the service with sudo service nginx reload.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…