Red Hat Security Advisory: nginx security update

Fixed packages 26

Vulnerabilities 4

• High 8.2
  CVE-2026-27654 Public exploit EPSS 26%

  NGINX ngx_http_dav_module vulnerability

  NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module that might allow an attacker to trigger a buffer overflow to the NGINX worker process; this vulnerability may result in termination of the NGINX worker process or modifica…

  F5 NGINX Plus NGINX Open Source nginx Network devices Debian Ubuntu Azure Linux Alpine Wolfi
  Mar 24, 2026
• High 7.8
  CVE-2026-27784

  NGINX ngx_http_mp4_module vulnerability

  The 32-bit implementation of NGINX Open Source has a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to over-read or over-write NGINX worker memory resulting in its termination, using a specially crafted MP4 file. The issue only…

  F5 NGINX Open Source nginx nginx Network devices Debian Ubuntu Azure Linux Alpine Wolfi
  Mar 24, 2026
• High 7.8
  CVE-2026-32647

  NGINX ngx_http_mp4_module vulnerability

  NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer over-read or over-write to the NGINX worker memory resulting in its termination or possibly code execution, using a spec…

  F5 NGINX Plus NGINX Open Source nginx Network devices Debian Ubuntu Azure Linux Alpine Wolfi
  Mar 24, 2026
• High 7.5
  CVE-2026-27651

  NGINX ngx_mail_auth_http_module vulnerability

  When the ngx_mail_auth_http_module module is enabled on NGINX Plus or NGINX Open Source, undisclosed requests can cause worker processes to terminate. This issue may occur when (1) CRAM-MD5 or APOP authentication is enabled, and (2) the authentication server …

  F5 NGINX Plus NGINX Open Source nginx Network devices Debian Ubuntu Azure Linux Alpine Wolfi
  Mar 24, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2449598
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2450776
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2450785
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2450791
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_13680.json
• report
  https://access.redhat.com/security/cve/CVE-2026-27651
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-27651
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-27651
• article
  https://my.f5.com/manage/s/article/K000160383
• report
  https://access.redhat.com/security/cve/CVE-2026-27654
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-27654
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-27654
• article
  https://my.f5.com/manage/s/article/K000160382
• report
  https://access.redhat.com/security/cve/CVE-2026-27784
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-27784
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-27784
• article
  https://my.f5.com/manage/s/article/K000160364
• report
  https://access.redhat.com/security/cve/CVE-2026-32647
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-32647
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-32647
• article
  https://my.f5.com/manage/s/article/K000160366