Riskcovery

CVE-2025-53859

NGINX ngx_mail_smtp_module vulnerability

State
Published
Severity
6.3 Medium
Published
Aug 13, 2025
Updated
Nov 4, 2025
Reserved
Jul 29, 2025

Read the record on cve.org

Description

NGINX Open Source and NGINX Plus have a vulnerability in the ngx_mail_smtp_module that might allow an unauthenticated attacker to over-read NGINX SMTP authentication process memory; as a result, the server side may leak arbitrary bytes sent in a request to the authentication server. This issue happens during the NGINX SMTP authentication process and requires the attacker to make preparations against the target system to extract the leaked data. The issue affects NGINX only if (1) it is built with the ngx_mail_smtp_module, (2) the smtp_auth directive is configured with method "none," and (3) the authentication server returns the "Auth-Wait" response header.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Scores

CVSSScoreVectorSource
4.06.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:Nf5
3.13.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:Nf5

Weaknesses

Affected Products

ProductVersions
NGINX PlusF5
  • R35Not affected
  • R34 to before R34 P2Affected
  • R33 to before R33 P3Affected
  • R32 to before R32 P3Affected
  • R31 and laterAffected
  • R30 and laterAffected
NGINX Open SourceF5
  • 0.7 to before 1.29.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.