CVE-2026-27784
HighCVSS 7.8Exploitation Probability (EPSS)
Elevated risk60th percentile - higher than 60% of all known CVEs
Summary
A vulnerability in the 32-bit NGINX Open Source ngx_http_mp4_module module allows an attacker to over-read or over-write worker memory using a crafted MP4 file, potentially causing worker termination. Only 32-bit builds with the module enabled and the mp4 directive in use are affected.
Risk Assessment
An attack can crash the NGINX worker process, leading to service disruption. In extreme cases, it may allow memory data leakage or corruption.
Recommendation
Upgrade NGINX Open Source to a patched version immediately. If upgrading is not possible, disable the ngx_http_mp4_module or remove the mp4 directive from the configuration.
Other vulnerabilities in NGINX Open Source
See all- CVE-2026-42530High
NGINX Open Source has a vulnerability in the ngx_http_v3_module. When configured with the HTTP/3 QUIC module, a remote unauthenticated attacker, under specific conditions, can use a crafted HTTP/3 session to reopen a QPACK encoder stream, causing a Use-after-Free in the NGINX worker process leading to a restart. On systems with ASLR disabled or bypassed, code execution is possible.
- CVE-2026-42926Medium
A vulnerability in NGINX Open Source allows an attacker to inject frame headers and payload bytes to the upstream peer when configured to proxy HTTP/2 and using proxy_set_body.
Original NVD description (English source)
The 32-bit implementation of NGINX Open Source has a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to over-read or over-write NGINX worker memory resulting in its termination, using a specially crafted MP4 file. The issue only affects 32-bit NGINX Open Source if it is built with the ngx_http_mp4_module module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted MP4 file with the ngx_http_mp4_module module. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.