CVE-2026-60065: NGINX Plus ngx_stream_mqtt_filter_module vulnerability
When NGINX Plus is configured to use the Message Queuing Telemetry Transport (MQTT) filter module (ngxstreammqttfiltermodule), unauthenticated attackers can send requests with conditions beyond the attacker's control to cause a heap buffer over-read in the NGINX worker process, leading to a restart.
Impact: This vulnerability may allow remote unauthenticated attackers to have limited control to restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-60065?
CVE-2026-60065 has a severity rating of low, with a score of 3.7.
What type of vulnerability is CVE-2026-60065?
CVE-2026-60065 is a heap buffer over-read vulnerability affecting the ngx_stream_mqtt_filter_module in NGINX Plus.
Who is affected by CVE-2026-60065?
CVE-2026-60065 affects users of NGINX Plus that have configured the Message Queuing Telemetry Transport filter module.
How do I mitigate CVE-2026-60065?
To mitigate CVE-2026-60065, avoid using the ngx_stream_mqtt_filter_module or apply the latest NGINX Plus patches as they become available.
Can CVE-2026-60065 be exploited remotely?
Yes, CVE-2026-60065 can be exploited by unauthenticated remote attackers who send specially crafted requests.