CVE-2026-60065

LowCVSS 3.7

Published: 15/07/2026(UTC)Updated: 10/08/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

18th percentile - higher than 18% of all known CVEs

Summary

A vulnerability in NGINX Plus with the MQTT filter module (ngx_stream_mqtt_filter_module) enabled allows unauthenticated attackers to send crafted requests causing a heap buffer over-read in the NGINX worker process, leading to a restart.

Risk Assessment

The risk involves remote unauthenticated attackers being able to restart the NGINX worker process, potentially causing service disruptions and destabilizing the production environment.

Recommendation

Immediately update NGINX Plus to the latest patched version and, if feasible, temporarily disable the MQTT filter module until the fix is applied.

Original NVD description (English source)

When NGINX Plus is configured to use the Message Queuing Telemetry Transport (MQTT) filter module (ngx_stream_mqtt_filter_module), unauthenticated attackers can send requests with conditions beyond the attacker's control to cause a heap buffer over-read in the NGINX worker process, leading to a restart. Impact: This vulnerability may allow remote unauthenticated attackers to have limited control to restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.