Worker Process Termination Vulnerability in NGINX Plus and Open Source
CVE-2026-27651

8.7HIGH

Key Information:

Vendor

F5
Status
Nginx Open Source
Nginx Plus
Vendor
CVE Published:
24 March 2026

What is CVE-2026-27651?

A vulnerability exists in NGINX Plus and NGINX Open Source when the ngx_mail_auth_http_module is activated. This flaw can lead to unwanted termination of worker processes during certain authentication scenarios. Specifically, when CRAM-MD5 or APOP authentication is enabled, retry attempts permitted by the authentication server can trigger a crash through the Auth-Wait response header. It is crucial for users to assess their configurations and take preventative measures to mitigate the risks associated with this vulnerability.

Affected Version(s)

NGINX Open Source 1.29.0 < 1.29.7

NGINX Open Source 0.5.15 < 1.28.3

NGINX Plus R36

References

https://my.f5.com/manage/s/article/K000160383
vendor-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

F5 acknowledges Arkadi Vainbrand for bringing this issue to our attention and following the highest standards of coordinated disclosure.
.