CVE-2026-60065

Name of the Vulnerable Software and Affected Versions NGINX Plus (affected versions not specified)

Description When configured to use the Message Queuing Telemetry Transport (MQTT) filter module (ngx stream mqtt filter module), unauthenticated remote attackers can send requests that trigger a heap buffer over-read in the NGINX worker process. A heap buffer over-read occurs when a program reads more data from a memory buffer than it is intended to, potentially accessing adjacent memory. This issue results in a restart of the NGINX worker process and is limited to the data plane, with no exposure of the control plane.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict the use of the ngx stream mqtt filter module module to minimize the risk of exploitation.