When the ngx_mail_auth_http_module module is enabled on NGINX Plus or NGINX Open Source, undisclosed requests can cause worker processes to terminate. This issue may occur when (1) CRAM-MD5 or APOP authentication is enabled, and (2) the authentication server permits retry by returning the Auth-Wait response header. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

The primary impact of CVE-2026-27651 is the potential for denial-of-service (DoS). An attacker can repeatedly send crafted authentication requests that trigger worker processes to terminate, effectively disrupting the Nginx server's ability to handle legitimate requests. This can lead to service unavailability and impact users relying on the Nginx server for web serving, reverse proxying, or mail handling. The vulnerability's reliance on the Auth-Wait header suggests an attack pattern where an attacker controls the authentication server and can manipulate the response to induce process termination. The blast radius is limited to the affected Nginx instances, but widespread exploitation could impact multiple services depending on Nginx.

Organizations running Nginx Plus or Nginx Open Source version 0.5.15–r35, particularly those utilizing the ngxmailauthhttpmodule with CRAM-MD5 or APOP authentication, are at risk. Shared hosting environments where multiple users share the same Nginx instance are also potentially vulnerable, as a compromised user could trigger the vulnerability affecting other users.

• nginx / server:

# Check Nginx version
nginx -v
# Monitor worker process health (look for unexpected terminations)
sysctl -n kernel.threads_created

• generic web:

# Check for Auth-Wait header in authentication responses (requires traffic analysis tools)
curl -I <authentication_endpoint>

1. 2026-03-24Disclosure

   disclosure

1. Reservado2026-03-18
2. Publicada2026-03-24
3. Modificada2026-03-30
4. EPSS actualizado2026-04-01

The recommended mitigation for CVE-2026-27651 is to upgrade to Nginx version R36 P3 or later, which includes the fix. If immediate upgrading is not possible, consider the following workarounds. First, disable the Auth-Wait response header on the authentication server. Second, if CRAM-MD5 or APOP authentication is not essential, disable these authentication methods entirely. Monitor Nginx worker process health and resource utilization for unusual spikes or terminations. Implement rate limiting on authentication requests to prevent rapid triggering of the vulnerability. After upgrading, confirm the fix by attempting to trigger the authentication flow with a crafted request and verifying that worker processes do not terminate.