NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_mp4_module that might allow a local attacker to cause a worker process crash, or might result in worker process memory disclosure by using a specially crafted audio or video file. The issue affects only NGINX products that are built with the module ngx_http_mp4_module, when the mp4 directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger processing of a specially crafted audio or video file with the module ngx_http_mp4_module.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nginx-mod-develUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-streamUpgrade nginx-all-modulesUpgrade nginx-mod-http-perlUpgrade nginx-coreUpgrade nginx-filesystemUpgrade nginx-mod-http-image-filterUpgrade nginxUpgrade nginx-mod-mail | May 22, 2025 | Oct 19, 2022 |
| Alpine Linux | — | Upgrade nginx | Mar 26, 2024 | Oct 19, 2022 |
| Amazon Linux Ami 2 | — | Upgrade nginx-debuginfoUpgrade nginx-mod-streamUpgrade nginx-filesystemUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-develUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-perlUpgrade nginx-mod-http-geoipUpgrade nginxUpgrade nginx-coreUpgrade nginx-all-modulesUpgrade nginx-mod-mail | Sep 28, 2023 | Oct 19, 2022 |
| Amazon_linux | — | Upgrade nginx | Jan 25, 2023 | Oct 19, 2022 |
| Amazon_linux_2023 | — | Upgrade nginx-mod-develUpgrade nginx-mod-streamUpgrade nginx-mod-http-xslt-filterUpgrade nginx-filesystemUpgrade nginx-debugsourceUpgrade nginx-debuginfoUpgrade nginx-mod-http-perlUpgrade nginx-all-modulesUpgrade nginx-core-debuginfoUpgrade nginx-mod-mailUpgrade nginx-mod-mail-debuginfoUpgrade nginx-coreUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginxUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-stream-debuginfoUpgrade nginx-mod-http-xslt-filter-debuginfo | Feb 17, 2025 | Oct 19, 2022 |
| Debian | — | Upgrade nginx | Nov 17, 2022 | Oct 19, 2022 |
| Freebsd | — | Upgrade nginxUpgrade nginx-devel | Nov 4, 2022 | Oct 19, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade nginx-mod-http-perlUpgrade nginx-mod-streamUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-xslt-filterUpgrade nginx-all-modulesUpgrade nginx-filesystemUpgrade nginx-mod-mailUpgrade nginx | Feb 9, 2023 | Oct 19, 2022 |
| Nginx | — | Upgrade to nginx version 1.22.1Upgrade to nginx version 1.23.2 | Oct 26, 2022 | Oct 19, 2022 |
| Oracle_linux | — | Upgrade nginx-mod-http-xslt-filterUpgrade nginx-filesystemUpgrade nginx-all-modulesUpgrade nginx-mod-mailUpgrade nginx-mod-http-image-filterUpgrade nginx-coreUpgrade nginx-mod-http-perlUpgrade nginx-mod-develUpgrade nginxUpgrade nginx-mod-stream | May 26, 2025 | Oct 19, 2022 |
| Redhat_linux | — | Upgrade nginx-core-debuginfoUpgrade nginx-mod-http-perlUpgrade nginxUpgrade nginx-mod-http-image-filterNo solution existsUpgrade nginx-mod-mailUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-mod-develUpgrade nginx-all-modulesUpgrade nginx-mod-stream-debuginfoUpgrade nginx-mod-mail-debuginfoUpgrade nginx-mod-http-xslt-filterUpgrade nginx-filesystemUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-debugsourceUpgrade nginx-mod-streamUpgrade nginx-debuginfoUpgrade nginx-core | May 15, 2025 | Oct 19, 2022 |
| Rocky_linux | — | Upgrade nginx-mod-streamUpgrade nginx-debugsourceUpgrade nginx-debuginfoUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-mod-mail-debuginfoUpgrade nginx-coreUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-perlUpgrade nginx-mod-mailUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginxUpgrade nginx-core-debuginfoUpgrade nginx-mod-develUpgrade nginx-mod-stream-debuginfo | Oct 13, 2025 | Oct 4, 2025 |
| Suse | — | Upgrade nginxUpgrade vim-plugin-nginxUpgrade nginx-source | Jan 30, 2023 | Oct 19, 2022 |
| Ubuntu | — | Upgrade nginx-common (Ubuntu Pro)Upgrade nginx-extras (Ubuntu Pro)Upgrade nginx-core (Ubuntu Pro)Upgrade nginx-lightUpgrade nginx-full (Ubuntu Pro)Upgrade nginx-light (Ubuntu Pro)Upgrade nginx-extrasUpgrade nginx-fullUpgrade nginx (Ubuntu Pro)Upgrade nginxUpgrade nginx-coreUpgrade nginx-common | Nov 15, 2022 | Oct 19, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 19, 2022 |
| Zimbra Collaboration | — | Upgrade Zimbra Collaboration to the latest version | Feb 26, 2025 | Oct 19, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub