Read the docs
TI-2025-33745 Aliases CVE-2025-53859GHSA-2qmj-q2xc-85v8

NGINX ngx_mail_smtp_module vulnerability

Priority LOW 28CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Partial Red Hat: 1 fixed, 4 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-125 and the CVSS impact.

Summary

NGINX Open Source and NGINX Plus have a vulnerability in the ngx_mail_smtp_module that might allow an unauthenticated attacker to over-read NGINX SMTP authentication process memory; as a result, the server side may leak arbitrary bytes sent in a request to the authentication server. This issue happens during the NGINX SMTP authentication process and requires the attacker to make preparations against the target system to extract the leaked data. The issue affects NGINX only if (1) it is built with the ngx_mail_smtp_module, (2) the smtp_auth directive is configured with method "none," and (3) the authentication server returns the "Auth-Wait" response header. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00439 38th percentileScored 2026-11-07
Fix Partial NGINX Plus (F5): R35, R34 P2, R33 P3 +1NGINX Open Source (F5): 1.29.1Red Hat: 1 advisoryRed Hat: 1 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
F5NGINX PlusR34 to before R34 P2; R33 to before R33 P3; R32 to before R32 P3; R31 and later; R30 and laterR35, R34 P2, R33 P3, R32 P3Patch availableCNA
F5NGINX Open Source0.7 to before 1.29.11.29.1Patch availableCNA
  • NGINX Plus VendorF5 Affected R34 to before R34 P2; R33 to before R33 P3; R32 to before R32 P3; R31 and later; R30 and later Fixed in R35, R34 P2, R33 P3, R32 P3 Patch available CNA
  • NGINX Open Source VendorF5 Affected 0.7 to before 1.29.1 Fixed in 1.29.1 Patch available CNA

CPE configurations NVD · 11

CPEVersionsRoleVendor
cpe:2.3:a:f5:nginx_plus:r30:-:*:*:*:*:*:*r30VulnerableF5
cpe:2.3:a:f5:nginx_plus:r31:-:*:*:*:*:*:*r31VulnerableF5
cpe:2.3:a:f5:nginx_plus:r32:-:*:*:*:*:*:*r32VulnerableF5
cpe:2.3:a:f5:nginx_plus:r32:p1:*:*:*:*:*:*r32 p1VulnerableF5
cpe:2.3:a:f5:nginx_plus:r32:p2:*:*:*:*:*:*r32 p2VulnerableF5
cpe:2.3:a:f5:nginx_plus:r33:-:*:*:*:*:*:*r33VulnerableF5
cpe:2.3:a:f5:nginx_plus:r33:p1:*:*:*:*:*:*r33 p1VulnerableF5
cpe:2.3:a:f5:nginx_plus:r33:p2:*:*:*:*:*:*r33 p2VulnerableF5
cpe:2.3:a:f5:nginx_plus:r34:-:*:*:*:*:*:*r34VulnerableF5
cpe:2.3:a:f5:nginx_plus:r34:p1:*:*:*:*:*:*r34 p1VulnerableF5
  • cpe:2.3:a:f5:nginx_plus:r30:-:*:*:*:*:*:* Versions r30 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx_plus:r31:-:*:*:*:*:*:* Versions r31 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx_plus:r32:-:*:*:*:*:*:* Versions r32 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx_plus:r32:p1:*:*:*:*:*:* Versions r32 p1 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx_plus:r32:p2:*:*:*:*:*:* Versions r32 p2 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx_plus:r33:-:*:*:*:*:*:* Versions r33 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx_plus:r33:p1:*:*:*:*:*:* Versions r33 p1 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx_plus:r33:p2:*:*:*:*:*:* Versions r33 p2 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx_plus:r34:-:*:*:*:*:*:* Versions r34 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx_plus:r34:p1:*:*:*:*:*:* Versions r34 p1 Vulnerable ·F5
Show 1 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:f5:nginx_open_source:*:*:*:*:*:*:*:*0.7.22 to before 1.29.1VulnerableF5
  • cpe:2.3:a:f5:nginx_open_source:*:*:*:*:*:*:*:* Versions 0.7.22 to before 1.29.1 Vulnerable ·F5

Remediation

  • Fix · CNA NGINX Plus (F5) Fixed in R35, R34 P2, R33 P3, R32 P3
  • Fix · CNA NGINX Open Source (F5) Fixed in 1.29.1

Red Hat 1 advisory

  • RHSA-2026:8346 Released 2026-04-15 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images nginx-1.30.0-1.hum1@aarch64, nginx-1.30.0-1.hum1@src, nginx-1.30.0-1.hum1@x86_64 +22

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred
Red Hat Lightspeed proxy 1AffectedNo fix yet: Fix deferred
Red Hat Hardened ImagesFixed RHSA-2026:8346

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-53859
  2. 2026-10-03 Alias added: GHSA-2qmj-q2xc-85v8

References

Advisory 1

  • TI-2026-31136 NGINX ngx_http_rewrite_module vulnerability CVSS 4.0CRITICAL 9.2
  • TI-2026-22036 NGINX ngx_http_dav_module vulnerability CVSS 4.0HIGH 8.8
  • TI-2026-08132 NGINX ngx_http_rewrite_module vulnerability CVSS 4.0CRITICAL 9.2
  • TI-2026-30812 NGINX Open-Source ngx_http_v3_module vulnerability CVSS 4.0CRITICAL 9.2
  • TI-2026-30432 NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability CVSS 4.0CRITICAL 9.2
  • TI-2026-42786 NGINX ngx_http_slice_module vulnerability CVSS 4.0HIGH 8.8
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences