CVE-2026-27784NGINX ngx_http_mp4_module vulnerability
Updated under an hour ago ()
Does this affect you?
It affects F5 NGINX Open Source and 6 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
The 32-bit implementation of NGINX Open Source has a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to over-read or over-write NGINX worker memory resulting in its termination, using a specially crafted MP4 file. The issue only affects 32-bit NGINX Open Source if it is built with the ngx_http_mp4_module module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted MP4 file with the ngx_http_mp4_module module. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-190
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- f5
- NVD analysis
- Modified
- Record last updated
- Jul 14, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
F5 NGINX Open Source f5:nginx_open_source (from the name) | from 1.29.0 before 1.29.7; from 1.1.19 before 1.28.3 | CNA record |
Red Hat Red Hat Enterprise Linux 10 redhat:enterprise_linux | from 2:1.26.3-2.el10_1.1 not affected | CISA ADP |
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support redhat:enterprise_linux_eus | from 2:1.26.3-1.el10_0.8 not affected | CISA ADP |
from 1:1.20.1-10.el9_0.3 not affected | CISA ADP | |
Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support redhat:rhel_eus | from 1:1.20.1-16.el9_4.5 not affected | CISA ADP |
Red Hat Red Hat Hardened Images redhat:hummingbird | from 1.30.0-1.hum1 not affected | CISA ADP |
Red Hat Red Hat Update Infrastructure 5 redhat:rhui | from 1776868774 not affected | CISA ADP |
f5 nginx_open_source f5:nginx_open_source | from 1.1.19 before 1.28.3; from 1.29.0 before 1.29.7 | NVD |
References
- https://my.f5.com/manage/s/article/K000160364vendor-advisory, mitigation
- https://access.redhat.com/errata/RHSA-2026:10065
- https://access.redhat.com/errata/RHSA-2026:13634
- https://access.redhat.com/errata/RHSA-2026:13680
- https://access.redhat.com/errata/RHSA-2026:13839
- https://access.redhat.com/errata/RHSA-2026:14836
- https://access.redhat.com/errata/RHSA-2026:15942
- https://access.redhat.com/errata/RHSA-2026:15943
- https://access.redhat.com/errata/RHSA-2026:15945
- https://access.redhat.com/errata/RHSA-2026:15966
- https://access.redhat.com/errata/RHSA-2026:6906
- https://access.redhat.com/errata/RHSA-2026:6907
- https://access.redhat.com/errata/RHSA-2026:6923
- https://access.redhat.com/errata/RHSA-2026:7002
- https://access.redhat.com/errata/RHSA-2026:7343
- https://access.redhat.com/errata/RHSA-2026:8346
- https://access.redhat.com/security/cve/CVE-2026-27784
- https://bugzilla.redhat.com/show_bug.cgi?id=2450785
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27784.json
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.