CVE-2026-60065: NGINX Plus ngx_stream_mqtt_filter_module vulnerability

Published Jul 15, 2026
·
Updated

When NGINX Plus is configured to use the Message Queuing Telemetry Transport (MQTT) filter module (ngxstreammqttfiltermodule), unauthenticated attackers can send requests with conditions beyond the attacker's control to cause a heap buffer over-read in the NGINX worker process, leading to a restart.

Affected Software

30 affected componentsFixes available
Nginx NGINX Plus
F5 NGINX Gateway Fabric>=1.3.0<=1.6.2
F5 NGINX Gateway Fabric>=2.0.0<2.6.7
F5 NGINX Ingress Controller>=3.5.0<=3.7.2
F5 NGINX Ingress Controller>=5.0.0<5.5.3
F5 NGINX Ingress Controller>=2026-lts-r1<2026-lts-r4
F5 NGINX Ingress Controller=4.0.0
F5 NGINX Ingress Controller=4.0.1
F5 NGINX Plus>=37.0.0.1<37.0.3.1
F5 NGINX Plus>=r33<r36
F5 NGINX Plus=r36
F5 NGINX Plus=r36-p1
F5 NGINX Plus=r36-p2
F5 NGINX Plus=r36-p3
F5 NGINX Plus=r36-p4
F5 NGINX Plus=r36-p5
F5 NGINX Plus=r36-p6
F5 Waf Nginx>=4.11.0<=4.16.0
F5 Waf Nginx>=5.2.0<=5.8.0
F5 Waf Nginx>=5.9.0<5.13.4
F5 NGINX Plus>=37.0.0.1<=37.0.2.1
37.0.3.1
F5 NGINX Plus=33
36
F5 F5 WAF for NGINX>=5.9.0<=5.13.3
5.13.4
F5 NGINX App Protect WAF>=5.2.0<=5.8.0
F5 NGINX App Protect WAF>=4.11.0<=4.16.0
F5 NGINX Gateway Fabric>=2.0.0<=2.6.6
2.6.7
F5 NGINX Gateway Fabric>=1.3.0<=1.6.2
F5 NGINX Ingress Controller>=1<=2026, =2026, >=5.0.0<=5.5.2
2026-
F5 NGINX Ingress Controller>=4.0.0<=4.0.1
F5 NGINX Ingress Controller>=3.5.0<=3.7.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 37.0.3.1
  2. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 36
  3. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 5.13.4
  4. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 2.6.7
  5. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 2026-

Event History

Jul 15, 2026
Advisory Published
via F5·01:44 PM
Data Sourced
via F5·01:44 PM
DescriptionSeverityWeaknessAffected Software
CVE Published
via MITRE·02:33 PM
Data Sourced
via MITRE·02:33 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:16 PM
DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2026-60065?

CVE-2026-60065 has a severity rating of low, with a score of 3.7.

2

What type of vulnerability is CVE-2026-60065?

CVE-2026-60065 is a heap buffer over-read vulnerability affecting the ngx_stream_mqtt_filter_module in NGINX Plus.

3

Who is affected by CVE-2026-60065?

CVE-2026-60065 affects users of NGINX Plus that have configured the Message Queuing Telemetry Transport filter module.

4

How do I mitigate CVE-2026-60065?

To mitigate CVE-2026-60065, avoid using the ngx_stream_mqtt_filter_module or apply the latest NGINX Plus patches as they become available.

5

Can CVE-2026-60065 be exploited remotely?

Yes, CVE-2026-60065 can be exploited by unauthenticated remote attackers who send specially crafted requests.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203