CVE-2026-32647

NGINX ngx_http_mp4_module vulnerability

HIGH

7.8

CVSS Score

Published: March 24, 2026 at 02:13 PM UTC

Updated: July 15, 2026 at 02:20 AM UTC

3 products affected across 2 vendorsNGINX PlusNGINX Open SourceLightspeed Proxy

Using NGINX Open Source by F5?

Get instant alerts when new vulnerabilities affect NGINX Open Source - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploit prediction

EPSS 0.9%

SSVC

No known exploit

Description

NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module, which might allow an attacker to trigger a buffer over-read or over-write to the NGINX worker memory resulting in its termination or possibly code execution, using a specially crafted mp4 file. This issue affects NGINX Open Source and NGINX Plus if it is built with the ngx_http_mp4_module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted mp4 file with the ngx_http_mp4_module. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

NGINX Open Source · F5

95%

1.1.19 ≤ v < 1.28.31.29.0 ≤ v < 1.29.71.1.19 1.29.0

Affected range stops below 1.28.3, so it looks safe — our inference, not a vendor statement

Affected range stops below 1.29.7, so it looks safe — our inference, not a vendor statement

NGINX Plus · F5

95%

v ≥ R33v ≥ R34R32 ≤ v < R32 P5R35 ≤ v < R35 P2R36 ≤ v < R36 P3R32 R33 R34 R35 R36 r32 p1 r32 p2 r32 p3 r32 p4r33r33 p1 r33 p2 r33 p3r34r34 p1 r34 p2r35r35 p1 r36 r36 p1 r36 p2

Affected range stops below R32 P5, so it looks safe — our inference, not a vendor statement

Affected range stops below R35 P2, so it looks safe — our inference, not a vendor statement

Affected range stops below R36 P3, so it looks safe — our inference, not a vendor statement

Lightspeed Proxy · Red Hat

60%

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://my.f5.com/manage/s/article/K000160366