CVE-2026-60065: nginx gateway fabric from 1.3.0 (inclusive), through 1.6.2 (inclusive), from 2.0.0 (inclusive), before 2.6.7…

Affected technology

nginx gateway fabric · from 1.3.0 (inclusive), through 1.6.2 (inclusive)
f5

nginx gateway fabric · from 2.0.0 (inclusive), before 2.6.7 (exclusive)
f5

nginx ingress controller · from 3.5.0 (inclusive), through 3.7.2 (inclusive)
f5

nginx ingress controller · from 5.0.0 (inclusive), before 5.5.3 (exclusive)
f5

nginx ingress controller · from 2026-lts-r1 (inclusive), before 2026-lts-r4 (exclusive)
f5

nginx ingress controller · 4.0.0
f5

nginx ingress controller · 4.0.1
f5

nginx plus · from 37.0.0.1 (inclusive), before 37.0.3.1 (exclusive)
f5

nginx plus · from r33 (inclusive), before r36 (exclusive)
f5

nginx plus · r36
f5

nginx plus · r36 · update p1
f5

nginx plus · r36 · update p2
f5

nginx plus · r36 · update p3
f5

nginx plus · r36 · update p4
f5

nginx plus · r36 · update p5
f5

nginx plus · r36 · update p6
f5

waf · from 4.11.0 (inclusive), through 4.16.0 (inclusive)
f5

waf · from 5.2.0 (inclusive), through 5.8.0 (inclusive)
f5

waf · from 5.9.0 (inclusive), before 5.13.4 (exclusive)
f5

NGINX Plus · 37.0.0.1 to before 37.0.3.1, R36 to before R36 P7, R33 to before *
F5

Component: ngx_stream_mqtt_filter_module

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

The source says when NGINX Plus is configured to use the Message Queuing Telemetry Transport (MQTT) filter module (ngx_stream_mqtt_filter_module), unauthenticated attackers can send requests with conditions beyond the attacker's control to cause a heap buffer over-read in the NGINX worker process, leading to a restart. Vendor/CNA’s CVSS 4.0 assessment (base score 6.3/10) rates confidentiality and integrity impact as none; availability impact as low.