Riskcovery

CVE-2026-32647

NGINX ngx_http_mp4_module vulnerability

State
Published
Severity
8.5 High
Published
Mar 24, 2026
Updated
Jul 15, 2026
Reserved
Mar 18, 2026

Read the record on cve.org

Description

NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer over-read or over-write to the NGINX worker memory resulting in its termination or possibly code execution, using a specially crafted MP4 file. This issue affects NGINX Open Source and NGINX Plus if it is built with the ngx_http_mp4_module module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted MP4 file with the ngx_http_mp4_module module.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Scores

CVSSScoreVectorSource
4.08.5 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:Nf5
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hf5
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hredhat-SADP

Weaknesses

Affected Products

ProductVersions
NGINX Open SourceF5
  • 1.29.0 to before 1.29.7Affected
  • 1.1.19 to before 1.28.3Affected
NGINX PlusF5
  • R36 to before R36 P3Affected
  • R35 to before R35 P2Affected
  • R34 and laterAffected
  • R33 and laterAffected
  • R32 to before R32 P5Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.