CVE-2026-60065

Awaiting Analysis Awaiting Analysis - Queue

Heap Buffer Over-Read in NGINX Plus MQTT Filter Module

Publication date: 2026-07-15

Last updated on: 2026-08-10

Assigner: F5 Networks

Description

When NGINX Plus is configured to use the Message Queuing Telemetry Transport (MQTT) filter module (ngx_stream_mqtt_filter_module), unauthenticated attackers can send requests with conditions beyond the attacker's control to cause a heap buffer over-read in the NGINX worker process, leading to a restart. Impact: This vulnerability may allow remote unauthenticated attackers to have limited control to restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-08-10

Generated

2026-08-25

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-23

NVD

CVE-2026-60065

EUVD

EUVD-2026-44685

Affected Vendors & Products

Vendor	Product	Version / Range
f5	nginx_plus	r36
f5	nginx_plus	r36
f5	nginx_plus	r36
f5	nginx_gateway_fabric	From 1.3.0 (inc) to 1.6.2 (inc)
f5	waf	From 5.2.0 (inc) to 5.8.0 (inc)
f5	nginx_plus	r36
f5	nginx_plus	r36
f5	nginx_plus	r36
f5	nginx_gateway_fabric	From 2.0.0 (inc) to 2.6.7 (exc)
f5	nginx_plus	From 37.0.0.1 (inc) to 37.0.3.1 (exc)
f5	nginx_plus	From r33 (inc) to r36 (exc)
f5	nginx_plus	r36
f5	waf	From 5.9.0 (inc) to 5.13.4 (exc)
f5	waf	From 4.11.0 (inc) to 4.16.0 (inc)
f5	nginx_ingress_controller	From 3.5.0 (inc) to 3.7.2 (inc)
f5	nginx_ingress_controller	From 5.0.0 (inc) to 5.5.3 (exc)
f5	nginx_ingress_controller	From 2026-lts-r1 (inc) to 2026-lts-r4 (exc)
f5	nginx_ingress_controller	4.0.0
f5	nginx_ingress_controller	4.0.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability affects NGINX Plus when configured with the MQTT filter module. Unauthenticated attackers can send specially crafted requests that cause a heap buffer over-read in the NGINX worker process, leading to an unexpected restart of the worker process.

Detection Guidance

Detecting this vulnerability requires monitoring NGINX Plus worker processes for unexpected restarts or crashes. Check NGINX logs for worker process termination events and inspect network traffic for unusual MQTT protocol anomalies. No specific commands are provided in the context.

Impact Analysis

This vulnerability allows remote unauthenticated attackers to cause NGINX worker processes to restart. This may lead to temporary service disruptions or degraded performance for users relying on NGINX Plus services.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA as it only allows unauthenticated attackers to restart the NGINX worker process without exposing the control plane or accessing sensitive data. However, repeated worker process restarts could lead to service disruptions, potentially affecting availability requirements in compliance frameworks.

Mitigation Strategies

Disable the MQTT filter module (ngx_stream_mqtt_filter_module) in NGINX Plus configuration. Update NGINX Plus to the latest patched version if available. Restrict network access to NGINX Plus instances to trusted sources only.

Hi! I’m here to help you understand CVE-2026-60065. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70