CVE-2026-27784: NGINX ngx_http_mp4_module vulnerability
Last updated 6 June 2026
Other sources
The 32-bit implementation of NGINX Open Source has a vulnerability in the ngxhttpmp4module module, which might allow an attacker to over-read or over-write NGINX worker memory resulting in its termination, using a specially crafted MP4 file. The issue only affects 32-bit NGINX Open Source if it is built with the ngxhttpmp4module module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted MP4 file with the ngxhttpmp4module module.
— F5
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.29.71.28.3 - Upgrade
Upgrade
debian/nginxto a version that resolves this vulnerability.Fixed in 1.18.0-6.1+deb11u6Fixed in 1.22.1-9+deb12u6Fixed in 1.22.1-9+deb12u7Fixed in 1.26.3-3+deb13u4Fixed in 1.26.3-3+deb13u5Fixed in 1.30.1-3 - Configuration
The vulnerability is only possible when NGINX Open Source is built with the ngx_http_mp4_module module and the mp4 directive is used in the configuration. Update the configuration to not use the mp4 directive (and do not enable ngx_http_mp4_module) so specially crafted MP4 processing cannot be triggered.
NGINX (ngx_http_mp4_module) mp4 directive usage = remove/avoid - Compensating control
Ensure that externally controllable requests cannot trigger processing of specially crafted MP4 files by ngx_http_mp4_module (e.g., block or restrict access to endpoints/paths that rely on the mp4 directive, or otherwise prevent clients from reaching MP4 processing).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27784?
CVE-2026-27784 is classified as a medium severity vulnerability affecting NGINX Open Source due to potential memory over-reads or over-writes.
How do I fix CVE-2026-27784?
To fix CVE-2026-27784, upgrade to NGINX Open Source version 1.29.71.28.3 or later.
What software is affected by CVE-2026-27784?
CVE-2026-27784 affects the 32-bit implementation of NGINX Open Source, particularly versions prior to the fixed release.
What kind of attacks can CVE-2026-27784 enable?
CVE-2026-27784 can allow attackers to terminate NGINX worker processes by exploiting specially crafted MP4 files.
Is CVE-2026-27784 specific to certain versions of NGINX?
Yes, CVE-2026-27784 specifically affects NGINX Open Source versions earlier than 1.29.71.28.3.