CVE-2026-60065: 
NixOS vulnerability analysis and mitigation

CVE-2026-60065 is a heap buffer over-read vulnerability in F5 NGINX Plus affecting the Message Queuing Telemetry Transport (MQTT) filter module (ngx_stream_mqtt_filter_module). When this module is enabled, unauthenticated remote attackers can send specially crafted requests to trigger a heap buffer over-read in the NGINX worker process, causing it to restart. Affected versions include NGINX Plus R33 through versions before R36 P7, and versions 37.0.0.1 through before 37.0.3.1. The vulnerability was published on July 15, 2026, and carries a CVSS v3.1 base score of 3.7 (Low) and a CVSS v4.0 base score of 6.3 (Medium) (GitHub Advisory, F5 Advisory).

The root cause is an out-of-bounds read (CWE-125) in the ngx_stream_mqtt_filter_module within NGINX Plus. When processing MQTT protocol messages, the module reads beyond the intended buffer boundary under certain conditions, triggering a heap buffer over-read that causes the NGINX worker process to crash and restart. Exploitation requires that the MQTT filter module be actively configured and loaded — it is not enabled by default — and the triggering conditions are described as partially beyond the attacker's control (CVSS Attack Requirements: Present), meaning reliable exploitation may require specific environmental or timing conditions. This is classified as a data plane issue only, with no control plane exposure (GitHub Advisory, F5 Advisory).

Successful exploitation results in a denial-of-service condition limited to the NGINX worker process restart, causing temporary service unavailability for clients connected through the affected NGINX Plus instance. There is no impact to confidentiality or integrity — attackers cannot read sensitive data, modify system data, or gain code execution through this vulnerability. The impact is confined to the data plane, and NGINX Plus's master process will automatically restart the worker, limiting the duration of any outage (GitHub Advisory).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been observed as of the time of disclosure (GitHub Advisory). The EPSS score is approximately 0.265%, placing it in the 18th percentile for exploitation likelihood within 30 days. The NVD SSVC assessment confirms exploitation status as "none" and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is further constrained by the requirement that the MQTT filter module be explicitly configured, limiting the attack surface to a subset of NGINX Plus deployments.

• Logs: Unexpected NGINX worker process crash/restart entries in system logs (e.g., /var/log/nginx/error.log) with messages indicating worker process termination and restart by the master process.
• Network: Anomalous or malformed MQTT protocol traffic directed at NGINX Plus stream listeners, particularly from untrusted or external IP addresses.
• Process: Repeated, unexpected respawning of NGINX worker processes (nginx: worker process) visible via process monitoring tools such as ps or system monitoring dashboards.

F5 has released patched versions of NGINX Plus: R36 P7 and 37.0.3.1 address this vulnerability; upgrading to these versions is the recommended remediation (F5 Advisory). NGINX Plus R33 and earlier versions that have reached End of Technical Support (EoTS) are not evaluated and should be upgraded. As an interim workaround, organizations that do not require MQTT filtering functionality should disable the ngx_stream_mqtt_filter_module in their NGINX Plus configuration. Additionally, implementing network-level access controls to restrict MQTT traffic to trusted sources only can reduce exposure.