GHSA-6364-x4qj-7w59

GHSA-6364-x4qj-7w59 PUBLISHED CVSS 7.800000190734863 HIGH

Record from GitHub Advisory Database · Published March 24, 2026

NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer over-read or over-write to the NGINX worker memory resulting in its termination or possibly code execution, using a specially crafted MP4 file. This issue affects NGINX Open Source and NGINX Plus if it is built with the ngx_http_mp4_module module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted MP4 file with the ngx_http_mp4_module module. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
nginx-stable	Wolfi	1.28.3-r0
nginx-stable	Chainguard	1.28.3-r0
nginx-mainline	Chainguard	1.29.7-r0
nginx-mainline	Wolfi	1.29.7-r0

Risk scores

CVSS 3.1

7.800000190734863

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Vendor	Product	Versions
wolfi	nginx-stable	0
chainguard	nginx-stable	0
chainguard	nginx-mainline	0
wolfi	nginx-mainline	0

Timeline

Mar 24, 2026 CVE Published
Aug 6, 2026 Distribution Patch (15 in total, the first dated here)
Aug 6, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-6364-x4qj-7w59
vulnetix vdb fixes GHSA-6364-x4qj-7w59

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-6364-x4qj-7w59/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →