CVE-2026-28755 NGINX ngx_stream_ssl_module vulnerability
Attackers can bypass certificate revocation checks in NGINX when specific SSL verification directives are enabled, allowing revoked certificates to be accepted.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-28755?
CVE-2026-28755 is a medium-severity vulnerability in F5 NGINX Open Source, published on 24 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_module module due to the improper handling of revoked certificates when configured with the ssl_verify_client on and ssl_ocsp on directives, allowing the TLS handshake to succeed even after an OCSP check identifies the certificate as revoked.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Weakness: CWE-863
Which versions are affected by CVE-2026-28755?
2 open source packages ship an affected version, including nginx and nginx-gateway. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
nginx Bitnami | From 1.27.2 | 1.28.3, 1.29.7 |
nginx-gateway Bitnami | From 1.27.2 | 1.28.3, 1.29.7 |
Products include F5 Nginx Open Source, F5 Nginx Plus.
How do I fix CVE-2026-28755?
Upgrade nginx to a fixed version for your release line: 1.28.3 or 1.29.7.
Is CVE-2026-28755 being exploited?
There is no known exploitation of CVE-2026-28755 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in F5 NGINX Open Source
Sources
Also known as ALPINE-CVE-2026-28755, AZL-80783, BELL-CVE-2026-28755, BIT-nginx-2026-28755, BIT-nginx-gateway-2026-28755, DEBIAN-CVE-2026-28755 and 5 more.