CVE-2026-27651

HIGH 7.5

NGINX ngx_mail_auth_http_module vulnerability

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

When the ngx_mail_auth_http_module module is enabled on NGINX Plus or NGINX Open Source, undisclosed requests can cause worker processes to terminate. This issue may occur when (1) CRAM-MD5 or APOP authentication is enabled, and (2) the authentication server permits retry by returning the Auth-Wait response header. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CWE	CWE-476
Vendor	f5
Product	nginx open source
Published	Mar 24, 2026
Last Updated	Mar 24, 2026

Stay Ahead of the Next One

Get instant alerts for f5 nginx open source

Be the first to know when new high vulnerabilities affecting f5 nginx open source are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

F5 / NGINX Open Source

1.29.0 < 1.29.7 0.5.15 < 1.28.3

F5 / NGINX Plus

R36 < R36 P3 R35 < R35 P2 R34 < * R33 < * R32 < R32 P5

References

NVD ↗ CVE.org ↗ EPSS Data ↗

my.f5.com: https://my.f5.com/manage/s/article/K000160383

Credits

🔍 F5 acknowledges Arkadi Vainbrand for bringing this issue to our attention and following the highest standards of coordinated disclosure.