CVE-2026-60065: NGINX Plus MQTT Filter DoS Vulnerability

CVE-2026-60065 Overview

CVE-2026-60065 is a heap buffer over-read vulnerability in NGINX Plus when configured with the Message Queuing Telemetry Transport (MQTT) filter module (ngx_stream_mqtt_filter_module). Unauthenticated remote attackers can send crafted requests that trigger an out-of-bounds read in the NGINX worker process, causing the worker to restart.

The flaw is classified as [CWE-125] Out-of-Bounds Read and affects the data plane only. There is no control plane exposure. The impact is limited to availability degradation of the worker process, with no confidentiality or integrity impact.

Critical Impact
Remote unauthenticated attackers can repeatedly restart NGINX worker processes handling MQTT traffic, disrupting message brokering for IoT and telemetry workloads.

Affected Products

NGINX Plus with ngx_stream_mqtt_filter_module enabled
F5 NGINX Plus deployments configured for MQTT stream processing
Software versions that have not reached End of Technical Support (EoTS)

Discovery Timeline

2026-07-15 - CVE-2026-60065 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-60065

Vulnerability Analysis

The vulnerability resides in the ngx_stream_mqtt_filter_module, a stream-layer module that parses MQTT protocol traffic passing through NGINX Plus. MQTT is a lightweight publish/subscribe messaging protocol widely used for IoT device communication and telemetry pipelines.

When the module processes attacker-supplied MQTT packets, it reads beyond the bounds of an allocated heap buffer. This out-of-bounds read causes the NGINX worker process to fault and restart. Because attackers control the trigger condition, they can repeat the request to force ongoing worker restarts.

The issue is scoped to the data plane. Administrative interfaces, configuration APIs, and the control plane remain unaffected. According to F5, exploitation does not grant code execution or information disclosure beyond the read fault itself.

Root Cause

The root cause is missing or insufficient bounds validation during MQTT packet parsing within ngx_stream_mqtt_filter_module. The module trusts field length values or offsets derived from attacker-controlled input, then reads past the allocated buffer boundary on the heap.

Attack Vector

An unauthenticated attacker sends malformed MQTT packets to any NGINX Plus listener where the MQTT filter module is enabled. No credentials, prior access, or user interaction are required. The network attack vector combined with low complexity allows the attack to be scripted and repeated to sustain a denial-of-service condition on the worker.

The vulnerability mechanism is a heap out-of-bounds read triggered by protocol parsing. No verified proof-of-concept code is publicly available. See the F5 Support Article K000162101 for vendor technical details.

Detection Methods for CVE-2026-60065

Indicators of Compromise

Unexpected NGINX worker process restarts logged in error.log with signal or segmentation fault entries
Elevated rate of MQTT stream connections from a single source followed by worker termination events
Gaps or resets in MQTT client sessions correlating with worker restart timestamps

Detection Strategies

Monitor NGINX error.log for worker process ... exited on signal messages tied to MQTT stream contexts
Inspect MQTT traffic for malformed packet structures, invalid remaining length fields, or truncated variable headers
Correlate spikes in TCP connection resets on MQTT listener ports with worker process metrics

Monitoring Recommendations

Enable NGINX Plus status metrics and alert on worker restart counters exceeding baseline
Deploy network detection rules that flag anomalous MQTT CONNECT, PUBLISH, or SUBSCRIBE packet structures
Aggregate stream module error events into a central SIEM for cross-source correlation

How to Mitigate CVE-2026-60065

Immediate Actions Required

Identify NGINX Plus instances with ngx_stream_mqtt_filter_module loaded and inventory exposed MQTT listeners
Apply the fixed NGINX Plus release referenced in F5 Support Article K000162101 as soon as available
Restrict network access to MQTT listener ports to trusted client subnets where operationally feasible

Patch Information

F5 provides remediation guidance and fixed version information in F5 Support Article K000162101. Administrators should consult the advisory for the specific NGINX Plus versions that address the heap buffer over-read in ngx_stream_mqtt_filter_module. Software versions that have reached End of Technical Support are not evaluated and should be upgraded.

Workarounds

Disable the ngx_stream_mqtt_filter_module in nginx.conf if MQTT filtering is not required for the deployment
Terminate MQTT traffic at a hardened upstream broker and route only validated traffic through NGINX Plus
Apply upstream ACLs or firewall rules to limit MQTT listener exposure to authenticated client networks

bash

# Example: remove the MQTT filter from a stream server block until patched
# /etc/nginx/nginx.conf
stream {
    server {
        listen 1883;
        # mqtt on;                    # disable MQTT filter
        # mqtt_rewrite_buffer_size 4k;
        proxy_pass mqtt_backend;
    }
}

# Reload NGINX to apply changes
nginx -t && nginx -s reload