CVE-2026-27651 — NGINX ngx_mail_auth_http_module vulnerability

Description (CNA)

When the ngx_mail_auth_http_module module is enabled on NGINX Plus or NGINX Open Source, undisclosed requests can cause worker processes to terminate. This issue may occur when (1) CRAM-MD5 or APOP authentication is enabled, and (2) the authentication server permits retry by returning the Auth-Wait response header. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected (CNA)

Vendor / product	Versions
F5 / NGINX Open Source	affected 1.29.0 before 1.29.7; affected 0.5.15 before 1.28.3
F5 / NGINX Plus	affected R36 before R36 P3; affected R35 before R35 P2; affected R34 before ; affected R33 before ; affected R32 before R32 P5

CWE

CWE-476

References

https://my.f5.com/manage/s/article/K000160383

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

A flaw was found in NGINX, specifically within the ngx_mail_auth_http_module. When this module is enabled, and CRAM-MD5 or APOP authentication is active with an authentication server that permits retries, undisclosed requests can cause NGINX worker processes to terminate. This can lead to a Denial of Service (DoS), making the affected NGINX instance unavailable to legitimate users.