The vulnerability of the ngx_http_mp4_module in NGINX Open Source HTTP servers allows attackers to expose sensitive information or cause service failures. NGINX Open Source Subscription, NGINX Plus, and NGINX Ingress Controller platforms for application monitoring and management provide solutions to address this issue.

🗓️ 24 Oct 2022 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 2 Views

The ngx_http_mp4_module flaw in Nginx Open Source enables memory overrun leading to data disclosure.

Reporter	Title	Published	Views	Family All 144
IBM Security Bulletins	Security Bulletin: A vulnerability in nginx may affect IBM Robotic Process Automation for Cloud Pak resulting in a denial of service (CVE-2022-41741, CVE-2022-41742)	4 Jan 202319:55	–	ibm
GithubExploit	Exploit for Type Confusion in Google Chrome	10 Feb 202523:04	–	githubexploit
GithubExploit	Exploit for Out-of-bounds Write in F5 Nginx	7 May 202523:26	–	githubexploit
FreeBSD	nginx -- Two vulnerabilities	19 Oct 202200:00	–	freebsd
Tenable Nessus	Amazon Linux 2022 : nginx, nginx-all-modules, nginx-core (ALAS2022-2023-270)	25 Jan 202300:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : nginx, nginx-all-modules, nginx-core (ALAS2023-2023-099)	21 Mar 202300:00	–	nessus
Tenable Nessus	Amazon Linux 2 : nginx (ALASNGINX1-2023-001)	27 Sep 202300:00	–	nessus
Tenable Nessus	Amazon Linux AMI : nginx (ALAS-2023-1665)	24 Jan 202300:00	–	nessus
Tenable Nessus	AlmaLinux 9 : nginx (ALSA-2025:7402)	21 May 202500:00	–	nessus
Tenable Nessus	Debian dla-3203 : libnginx-mod-http-auth-pam - security update	24 Nov 202200:00	–	nessus

Vulners

Node

nginx nginx_ingress_controllerRange1.9.0–1.12.5

OR

nginx nginx_ingress_controllerRange2.0.0–2.4.1

OR

nginx nginx_open_sourceRange1.23.0–1.23.2

OR

nginx nginx_open_sourceRange1.1.3–1.22.1

Source	Link
support	www.support.f5.com/csp/article/K28112382
altsp	www.altsp.su/obnovleniya-bezopasnosti/
abf	www.abf.rosa.ru/advisories/ROSA-SA-2025-2895
web	www.web.nvd.nist.gov/view/vuln/detail

19 Aug 2025 00:00Current

7.6High risk

Vulners AI Score7.6

CVSS 26.2

CVSS 37.1

EPSS0.01069

nginx open source mp4 module flaw memory overrun data disclosure service disruption nginx subscription nginx plus nginx ingress controller