TI-2022-20130 Aliases CVE-2022-41743 GHSA-g286-fgpf-9wp8

NGINX ngx_http_hls_module vulnerability CVE-2022-41743

LOW 32CWE-787Published 2022-10-19 · Updated 2025-05-08

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: High
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_hls_module that might allow a local attacker to corrupt NGINX worker memory, resulting in its crash or potential other impact using a specially crafted audio or video file. The issue affects only NGINX Plus when the hls directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger processing of a specially crafted audio or video file with the module ngx_http_hls_module.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0023 13th percentileScored 2026-11-07

Fix Fixed NGINX Plus (F5): R27-p1, R26-p1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
F5	NGINX Plus	R27 to before R27-p1; R1 to before R26-p1	R27-p1, R26-p1	Patch available	CNA

NGINX Plus VendorF5 Affected R27 to before R27-p1; R1 to before R26-p1 Fixed in R27-p1, R26-p1 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:f5:nginx_ingress_controller::::::::	1.9.0 – 1.12.4; 2.0.0 – 2.4.0	Vulnerable	F5
cpe:2.3:a:f5:nginx_plus::::::::	r22 – r27	Vulnerable	F5

cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:* Versions 1.9.0 – 1.12.4; 2.0.0 – 2.4.0 Vulnerable ·F5
cpe:2.3:a:f5:nginx_plus:*:*:*:*:*:*:*:* Versions r22 – r27 Vulnerable ·F5

Remediation

Fix · CNA NGINX Plus (F5) Fixed in R27-p1, R26-p1

Timeline

2026-10-02 Threatist record created from CVE-2022-41743
2026-10-03 Alias added: GHSA-g286-fgpf-9wp8

References

Advisory 1

https://support.f5.com/csp/article/K01112063

TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
TI-2026-31136 NGINX ngx_http_rewrite_module vulnerability CVSS 4.0CRITICAL 9.2
TI-2026-30813 NGINX Map directive and Regex matching vulnerability CVSS 4.0CRITICAL 9.2
TI-2026-08132 NGINX ngx_http_rewrite_module vulnerability CVSS 4.0CRITICAL 9.2
TI-2026-30812 NGINX Open-Source ngx_http_v3_module vulnerability CVSS 4.0CRITICAL 9.2
TI-2026-30432 NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability CVSS 4.0CRITICAL 9.2

See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences