BIT-NGINX-2025-53859 NGINX ngx_mail_smtp_module vulnerability

🗓️ 18 Aug 2025 08:07:31Reported by GoogleType

osv🔗 osv.dev👁 58 Views

NGINX SMTP module vulnerability allows unauthenticated memory over-read of authentication data, leaking bytes; requires module, smtp_auth none, and authentication server returns Auth-Wait header.

Reporter	Title	Published	Views	Family All 106
Tenable Nessus	Amazon Linux 2023 : nginx, nginx-all-modules, nginx-core (ALAS2023-2025-1152)	18 Aug 202500:00	–	nessus
Tenable Nessus	Amazon Linux 2 : nginx, --advisory ALAS2NGINX1-2025-009 (ALASNGINX1-2025-009)	19 Aug 202500:00	–	nessus
Tenable Nessus	Debian dla-4589 : libnginx-mod-http-auth-pam - security update	18 May 202600:00	–	nessus
Tenable Nessus	Fedora 44 : nginx / nginx-mod-brotli / nginx-mod-fancyindex / etc (2025-530e10091c)	26 Dec 202500:00	–	nessus
Tenable Nessus	Fedora 43 : nginx / nginx-mod-brotli / nginx-mod-fancyindex / etc (2025-8aa169ea14)	2 Jan 202600:00	–	nessus
Tenable Nessus	Fedora 42 : nginx / nginx-mod-brotli / nginx-mod-fancyindex / etc (2025-8caa129b2e)	3 Jan 202600:00	–	nessus
Tenable Nessus	FreeBSD : nginx -- worker process memory disclosure (eb03714d-79f0-11f0-b4c1-ac5afc632ba3)	15 Aug 202500:00	–	nessus
Tenable Nessus	GLSA-202608-16 : nginx: Multiple Vulnerabilities	18 Aug 202600:00	–	nessus
Tenable Nessus	nginx 0.7.22 < 1.29.1 Information Disclosure	22 Aug 202500:00	–	nessus
Tenable Nessus	Photon OS 4.0: Nginx PHSA-2025-4.0-0852	20 Aug 202500:00	–	nessus

Source	Link
my	www.my.f5.com/manage/s/article/K000152786
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-53859
openwall	www.openwall.com/lists/oss-security/2025/08/13/5

03 Dec 2025 12:29Current

7.5High risk

Vulners AI Score7.5

CVSS 3.13.7

CVSS 46.3

EPSS0.00394

SSVC