F5 NGINX Plus & Open‑Source Flaw Lets Attackers Execute Code via MP4 File
F5 has identified a significant vulnerability (CVE-2026-32647) in the NGINX ngx_http_mp4_module that could enable attackers to execute arbitrary code or initiate a denial-of-service (DoS) using specifically crafted MP4 files.
F5 has identified a significant vulnerability (CVE-2026-32647) in the NGINX ngx_http_mp4_module that could enable attackers to execute arbitrary code or initiate a denial-of-service (DoS) using specifically crafted MP4 files.
This vulnerability affects NGINX Plus and NGINX Open Source setups where the MP4 streaming module is manually activated in the server configuration.
The vulnerability, labeled CVE-2026-32647, is categorized under CWE-125 as an out-of-bounds read.
It holds a CVSS v4.0 score of 8.5 and a CVSS v3.1 score of 7.8, indicating high severity.
The flaw is confined to the data plane and necessitates a local, authenticated attacker to upload or trigger the processing of a crafted MP4 file.
When processed by NGINX, the crafted file can instigate a buffer over-read or over-write.
This memory corruption causes the NGINX worker process to restart, potentially leading to a DoS condition.
Under certain scenarios, this memory corruption might be exploited to achieve remote code execution on the host server.
This vulnerability affects NGINX Plus and NGINX Open Source setups where the MP4 streaming module is manually activated in the server configuration.
It is important to note that the MP4 module is not enabled by default in NGINX Open Source, affecting only those configurations where the mp4 directive is explicitly included.
F5 has confirmed that this vulnerability impacts several versions of its web server software and has issued official patches.
For NGINX Plus, the affected versions are from R32 through R36 in the R3x branch.
Administrators should upgrade to versions R36 P3, R35 P2, or R32 P5 to address this issue.
For NGINX Open Source, versions from 1.1.19 through 1.29.6 are impacted.
Fixes have been applied in versions 1.29.7 and 1.28.3.
Other F5 products, including BIG-IP Next, BIG-IQ Centralized Management, F5OS, and F5 Distributed Cloud Services, are not affected by this MP4 module vulnerability.
Administrators unable to immediately apply the official updates may implement temporary workarounds.
A primary mitigation strategy is limiting the upload of audio and video files to trusted users only.
Alternatively, organizations can disable MP4 pseudo-streaming support by commenting out the mp4 directives in NGINX configuration files, typically located in the /etc/nginx directory.
To neutralize the module, insert a hash character ( # ) before any mp4 directives in the http , server , or location contexts.
After making these changes, verify the syntax with sudo nginx -t and safely apply the update by reloading the service with sudo service nginx reload .
Based on reporting by GBHackers.