3.7
Low
CVE-2026-60065 When NGINX Plus is configured to use the Message Queuing Telemetry Transport (MQTT) filter module…
Description
When NGINX Plus is configured to use the Message Queuing Telemetry Transport (MQTT) filter module (ngx_stream_mqtt_filter_module), unauthenticated attackers can send requests with conditions beyond the attacker's control to cause a heap buffer over-read in the NGINX worker process, leading to a restart. Impact: This vulnerability may allow remote unauthenticated attackers to have limited control to restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| NGINX Plus 37.0 | 37.0.0.1 → < 37.0.3.1 | 37.0.3.1 |
References
- my.f5.com my.f5.com
Timeline
- Published
- Last modified
Other CVEs of NGINX Plus
The 37 CVEs of NGINX Plus →
CVE-2026-95101
Description
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module
5.3
Medium
CVE-2026-93479
A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root…
8.1
High
CVE-2026-97205
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module
8.1
High
CVE-2026-15176
A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive…
8.1
High