CVE-2026-32647

Name of the Vulnerable Software and Affected Versions NGINX Open Source and NGINX Plus versions (affected versions not specified)

Description NGINX Open Source and NGINX Plus, when built with the ngx http mp4 module module and configured with the mp4 directive, are susceptible to a buffer over-read or over-write in the NGINX worker memory. This can occur when processing a specially crafted MP4 file, potentially leading to service termination or code execution. The issue is exploitable only if an attacker can trigger the processing of the malicious MP4 file using the ngx http mp4 module module.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.