Skip to content
OpenAdvisories
High · 7.0 Public exploit CVE-2022-41741 EUVD-2022-44912GHSA-3v5h-538g-pr7g

NGINX ngx_http_mp4_module vulnerability CVE-2022-41741

Published Oct 19, 2022 · Updated May 8, 2025 · Assigned by f5

Vendor: F5 Product: NGINX Product: NGINX Open Source Subscription Product: NGINX Plus Package: nginx Package: nginx Package: nginx Package: nginx Category: Network devices Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_mp4_module that might allow a local attacker to corrupt NGINX worker memory, resulting in its termination or potential other impact using a specially crafted audio or video file. The issue affects only NGINX products that are built with the ngx_http_mp4_module, when the mp4 directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger processing of a specially crafted audio or video file with the module ngx_http_mp4_module.

Affected products

VendorProductAffectedFixed
F5 NGINX Mainline – < 1.23.2, Stable – < 1.22.1 1.23.2
F5 NGINX Plus R27 – < R27-p1, R1 – < R26-p1 R27-p1
F5 NGINX Open Source Subscription R2 – < R2 P1, R1 – < R1 P1 R2 P1

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 nginx 1.22.1-1 —
Debian 13 nginx 1.22.1-1 —
Debian 12 nginx 1.22.1-1 —
Debian 11 nginx 1.18.0-6.1+deb11u3 DSA-5281-1
Debian 10 nginx 1.14.2-2+deb10u5 DLA-3203-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS nginx 1.18.0-6ubuntu14.3 USN-5722-1
Ubuntu 20.04 LTS nginx 1.18.0-0ubuntu1.4 USN-5722-1
Ubuntu 18.04 LTS nginx 1.14.0-0ubuntu1.11 USN-5722-1
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 16.04 LTS nginx 1.10.3-0ubuntu0.16.04.5+esm5 USN-5722-1
Ubuntu Pro 14.04 LTS nginx 1.4.6-1ubuntu3.9+esm4 USN-5722-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 9 nginx +9 2:1.20.1-22.el9_6.2 RHSA-2025:7402
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 9.4 EUS nginx +9 1:1.20.1-16.el9_4.3 RHSA-2025:7619
RHEL 9.2 EUS nginx +9 1:1.20.1-14.el9_2.3 RHSA-2025:7546

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 9 nginx +9 2:1.20.1-22.el9_6.2.alma.1 ALSA-2025:7402

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 9 nginx 2:1.20.1-22.el9_6.2 RLSA-2025:7402

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP4 nginx 1.21.5-150400.3.3.1 SUSE-SU-2023:0212-1
SLES 15 SP3 nginx 1.19.8-150300.3.12.1 SUSE-SU-2023:0205-1
SLES 15 SP2 nginx 1.16.1-150200.3.12.1 SUSE-SU-2023:0210-1
SLES 15 SP1 nginx 1.16.1-150100.6.19.1 SUSE-SU-2023:0293-1
Show 13 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP3 nginx 1.19.8-150300.3.12.1 SUSE-SU-2023:0205-1
SLES for SAP 15 SP2 nginx 1.16.1-150200.3.12.1 SUSE-SU-2023:0210-1
SLES for SAP 15 SP1 nginx 1.16.1-150100.6.19.1 SUSE-SU-2023:0293-1
SLE Real Time 15 SP3 nginx 1.19.8-150300.3.12.1 SUSE-SU-2023:0205-1
SLE HPC 15 SP3 nginx 1.19.8-150300.3.12.1 SUSE-SU-2023:0205-1
SLE HPC 15 SP2 nginx 1.16.1-150200.3.12.1 SUSE-SU-2023:0210-1
SLE HPC 15 SP1 nginx 1.16.1-150100.6.19.1 SUSE-SU-2023:0293-1
SUSE Manager Server 4.2 nginx 1.19.8-150300.3.12.1 SUSE-SU-2023:0205-1
SUSE Manager Retail Branch Server 4.2 nginx 1.19.8-150300.3.12.1 SUSE-SU-2023:0205-1
SUSE Manager Proxy 4.2 nginx 1.19.8-150300.3.12.1 SUSE-SU-2023:0205-1
SUSE Enterprise Storage 7.1 nginx 1.19.8-150300.3.12.1 SUSE-SU-2023:0205-1
SUSE Enterprise Storage 7 nginx 1.16.1-150200.3.12.1 SUSE-SU-2023:0210-1
SUSE Enterprise Storage 6 nginx 1.16.1-150100.6.19.1 SUSE-SU-2023:0293-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed nginx 1.23.2-1.1 openSUSE-SU-2024:12433-1
openSUSE Leap 15.4 nginx 1.19.8-150300.3.12.1 SUSE-SU-2023:0212-1, SUSE-SU-2023:0205-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 nginx 1.22.1-r0 —
Alpine v3.23 nginx 1.22.1-r0 —
Alpine v3.22 nginx 1.22.1-r0 —
Alpine v3.21 nginx 1.22.1-r0 —
Alpine v3.20 nginx 1.22.1-r0 —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 nginx 1.22.1-r0 —
Alpine v3.18 nginx 1.22.1-r0 —
Alpine v3.17 nginx 1.22.1-r0 —
Alpine v3.16 nginx 1.22.1-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 nginx +9 1:1.22.1-1.amzn2023.0.2 ALAS2023-2023-099

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 2 (CBL-Mariner) nginx 1.22.1-1 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 nginx +9 2:1.20.1-22.0.1.el9_6.2 ELSA-2025-7402

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 2 repositories

  • moften/CVE-2022-41741-742-Nginx-Vulnerability-Scanner ★ 1 · May 7, 2025

    CVE-2022-41741/742 Nginx Vulnerability Scanner

  • dumbbutt0/evilMP4 ★ 1 · Apr 26, 2024

    Explore CVE-2022-41741 with the Evil MP4 repository. It offers educational PoCs,and documentation on securing nginx against MP4 file vulnerabilities. For legal, ethical security testing only.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 17

References