CVE-2026-27651 NGINX ngx_mail_auth_http_module vulnerability
Attackers can crash NGINX worker processes via crafted requests when mail authentication with retry support is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-27651?
CVE-2026-27651 is a high-severity vulnerability in F5 NGINX Open Source, published on 24 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When the ngx_mail_auth_http_module module is enabled on NGINX Plus or NGINX Open Source, undisclosed requests can cause worker processes to terminate. This issue may occur when (1) CRAM-MD5 or APOP authentication is enabled, and (2) the authentication server permits retry by returning the Auth-Wait response header. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Weakness: CWE-476
Which versions are affected by CVE-2026-27651?
2 open source packages ship an affected version, including nginx and nginx-gateway. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
nginx Bitnami | From 0.5.15 | 1.28.3, 1.29.7 |
nginx-gateway Bitnami | From 0.5.15 | 1.28.3, 1.29.7 |
Products include F5 Nginx Open Source, F5 Nginx Plus.
How do I fix CVE-2026-27651?
Upgrade nginx to a fixed version for your release line: 1.28.3 or 1.29.7.
Is CVE-2026-27651 being exploited?
There is no known exploitation of CVE-2026-27651 in the wild and no public exploit code.
Other vulnerabilities in F5 NGINX Open Source
Sources
Also known as ALPINE-CVE-2026-27651, AZL-80771, BELL-CVE-2026-27651, BIT-nginx-2026-27651, BIT-nginx-gateway-2026-27651, DEBIAN-CVE-2026-27651 and 10 more.