CVE-2026-27784: Memory Corruption in Nginx Open Source

Successful exploitation of CVE-2026-27784 allows an attacker to trigger a denial-of-service (DoS) condition by causing Nginx worker processes to crash. The vulnerability stems from an issue in the 32-bit implementation of the ngxhttpmp4_module module. The crafted MP4 file exploits a flaw in how Nginx handles the file, leading to memory over-read or over-write. This is particularly concerning for environments heavily reliant on Nginx for serving media content, as a malicious MP4 file could disrupt service availability. The attack requires the attacker to be able to trigger the processing of the crafted MP4 file by Nginx.

1. Reserved2026-03-18
2. Published2026-03-24
3. Modified2026-03-30
4. EPSS updated2026-04-01

The primary mitigation for CVE-2026-27784 is to upgrade Nginx Open Source to version 1.29.7 or later. If upgrading is not immediately feasible, consider disabling the ngxhttpmp4_module module by removing it from the Nginx configuration file. This will prevent the processing of MP4 files by the vulnerable module. Additionally, implement strict input validation for MP4 files served by Nginx to prevent the upload or processing of potentially malicious files. Monitor Nginx error logs for unusual crashes or memory-related errors that could indicate exploitation attempts. After upgrading, confirm the fix by attempting to serve a known-good MP4 file and verifying that Nginx processes it without errors.