Description
NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module, which might allow an attacker to over-read NGINX worker memory resulting in its termination, using a specially crafted mp4 file. The issue only affects NGINX if it is built with the ngx_http_mp4_module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted mp4 file with the ngx_http_mp4_module. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| F5 | NGINX Open Source | 1.5.13 | — |
| F5 | NGINX Plus | R4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nginx | 1.26.0-2 | — |
| Debian 13 | nginx | 1.26.0-2 | — |
| Debian 12 | nginx | 1.22.1-9+deb12u2 | — |
| Debian 11 | nginx | 1.18.0-6.1+deb11u4 | DLA-4091-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | nginx | 1.24.0-2ubuntu7.1 | USN-7014-1 |
| Ubuntu 22.04 LTS | nginx | 1.18.0-6ubuntu14.5 | USN-7014-1 |
| Ubuntu 20.04 LTS | nginx | 1.18.0-0ubuntu1.6 | USN-7014-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | nginx | 1.14.0-0ubuntu1.11+esm1 | USN-7014-2 |
| Ubuntu Pro 16.04 LTS | nginx | 1.10.3-0ubuntu0.16.04.5+esm6 | USN-7014-2 |
| Ubuntu Pro 14.04 LTS | nginx | 1.4.6-1ubuntu3.9+esm5 | USN-7014-3 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | nginx +9 | 1:1.22.1-8.module+el9.5.0+22953+b175c265.1 | RHSA-2025:7402, RHSA-2025:3262, RHSA-2025:3261 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.4 EUS | nginx +9 | 1:1.20.1-16.el9_4.3 | RHSA-2025:7619, RHSA-2025:7549, RHSA-2025:7542 |
| RHEL 9.2 EUS | nginx +9 | 1:1.20.1-14.el9_2.3 | RHSA-2025:7548, RHSA-2025:7546 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | nginx +9 | 1:1.22.1-8.module_el9.5.0+153+8c633b18.1.alma.1 | ALSA-2025:7402, ALSA-2025:3262, ALSA-2025:3261 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | nginx | 1:1.22.1-8.module+el9.6.0+32001+2660e3dc.1 | RLSA-2025:7402, RLSA-2025:3262, RLSA-2025:3261 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | nginx | 1.21.5-150600.10.3.1 | SUSE-SU-2025:0283-1 |
| SLES 15 SP5 | nginx | 1.21.5-150400.3.6.1 | SUSE-SU-2025:0282-1 |
| SLES 15 SP4 | nginx | 1.21.5-150400.3.6.1 | SUSE-SU-2025:0282-1 |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP5 | nginx | 1.21.5-150400.3.6.1 | SUSE-SU-2025:0282-1 |
| SLES for SAP 15 SP4 | nginx | 1.21.5-150400.3.6.1 | SUSE-SU-2025:0282-1 |
| SLE HPC 15 SP5 | nginx | 1.21.5-150400.3.6.1 | SUSE-SU-2025:0282-1 |
| SLE HPC 15 SP4 | nginx | 1.21.5-150400.3.6.1 | SUSE-SU-2025:0282-1 |
| SUSE Manager Server 4.3 | nginx | 1.21.5-150400.3.6.1 | SUSE-SU-2025:0282-1 |
| SUSE Manager Proxy 4.3 | nginx | 1.21.5-150400.3.6.1 | SUSE-SU-2025:0282-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | nginx | 1.27.1-1.1 | openSUSE-SU-2024:14271-1 |
| openSUSE Leap 15.6 | nginx | 1.21.5-150600.10.3.1 | SUSE-SU-2025:0283-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | nginx | 1.26.2-r0 | — |
| Alpine v3.23 | nginx | 1.26.2-r0 | — |
| Alpine v3.22 | nginx | 1.26.2-r0 | — |
| Alpine v3.21 | nginx | 1.26.2-r0 | — |
| Alpine v3.20 | nginx | 1.26.2-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | nginx +9 | 1:1.24.0-1.amzn2023.0.3 | ALAS2023-2024-707 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | nginx | 1.25.4-2 | — |
| Azure Linux 2 (CBL-Mariner) | nginx | 1.22.1-12 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | nginx +9 | 1:1.22.1-8.0.1.module+el9.5.0+90542+e87a1bbf.1 | ELSA-2025-7402, ELSA-2025-3262, ELSA-2025-3261 |
Advisories 26
- ALSA-2025:7402 Moderate: nginx security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:3261 Moderate: nginx:1.22 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:3262 Moderate: nginx:1.24 security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2025:7619 Red Hat Security Advisory: nginx security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2025:7546 Red Hat Security Advisory: nginx security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2025:7402 Red Hat Security Advisory: nginx security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- WID-SEC-2024-1863 NGINX und NGINX Plus: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Sep 15, 2026
- RHSA-2025:7548 Red Hat Security Advisory: nginx:1.22 security update Red Hat Security Advisories (RHSA) · Jul 12, 2026
- RHSA-2025:7549 Red Hat Security Advisory: nginx:1.22 security update Red Hat Security Advisories (RHSA) · Jul 12, 2026
- RHSA-2025:7542 Red Hat Security Advisory: nginx:1.24 security update Red Hat Security Advisories (RHSA) · Jul 12, 2026
- RHSA-2025:3262 Red Hat Security Advisory: nginx:1.24 security update Red Hat Security Advisories (RHSA) · Jul 12, 2026
- RHSA-2025:3261 Red Hat Security Advisory: nginx:1.22 security update Red Hat Security Advisories (RHSA) · Jul 12, 2026
- USN-7014-3 nginx vulnerability Ubuntu Security Notices (USN) · Jun 29, 2026
- USN-7014-2 nginx vulnerability Ubuntu Security Notices (USN) · Jun 25, 2026
- USN-7014-1 nginx vulnerability Ubuntu Security Notices (USN) · Apr 22, 2026
- DLA-4091-1 nginx - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:14271-1 nginx-1.27.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:0283-1 Security update for nginx SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:0282-1 Security update for nginx SUSE / openSUSE Security Updates · Feb 4, 2026
- RLSA-2025:3262 Moderate: nginx:1.24 security update Rocky Linux Security Advisories · Oct 7, 2025
- RLSA-2025:3261 Moderate: nginx:1.22 security update Rocky Linux Security Advisories · Oct 7, 2025
- RLSA-2025:7402 Moderate: nginx security update Rocky Linux Security Advisories · Oct 4, 2025
- ELSA-2025-7402 Moderate: nginx security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 21, 2025
- ELSA-2025-3262 Moderate: nginx:1.24 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Mar 27, 2025
- ELSA-2025-3261 Moderate: nginx:1.22 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Mar 27, 2025
- ALAS2023-2024-707 Moderate: nginx security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Sep 4, 2024
References
- https://my.f5.com/manage/s/article/K000140529 vendor-advisory