NGINX Plus CVE-2026-60065

Exploitation requires NGINX Plus to be explicitly configured with the ngx_stream_mqtt_filter_module in a stream block - this is a non-default, operator opt-in configuration absent from standard NGINX Plus deployments. Additionally, successful crash triggering depends on runtime conditions partly outside the attacker's control (CVSS 4.0 AT:P), meaning exploitation cannot be reliably or deterministically repeated. The impact is strictly limited to crashing the NGINX worker process, which the master process respawns automatically; there is no path to code execution, privilege escalation, data disclosure, or control plane access. Exploitation is further bounded to attackers with network reachability to the MQTT stream listener port, and no authentication is required once that access exists (CVSS PR:N).

The vendor-assigned CVSS 4.0 score of 6.3 reflects a moderate, availability-only risk profile. The network attack vector (AV:N) and absence of required privileges (PR:N) or user interaction (UI:N) indicate ease of initiation, but the AT:P metric (Attack Requirements: Present) meaningfully constrains reliable exploitation, as successful triggering depends on runtime conditions partially outside the attacker's control - consistent with the description's phrasing. Impact metrics confirm no confidentiality (VC:N) or integrity (VI:N) consequence; only low vulnerable-system availability impact (VA:L) applies, consistent with a worker restart rather than full service failure. No EPSS data was provided, so statistical exploitation probability cannot be quantified. No CISA KEV listing and no public proof-of-concept were identified, placing exploitation likelihood in the lower tier. The primary practical risk limiter is the non-default configuration prerequisite: the MQTT filter module must be explicitly enabled, meaning the vast majority of NGINX Plus deployments are not exposed. For organizations using NGINX Plus as an MQTT stream proxy, this is a genuine but moderate priority, not an emergency.

An unauthenticated attacker who has network access to an NGINX Plus instance with the MQTT filter module enabled sends a specially crafted MQTT protocol message to the stream listener port. Under specific runtime conditions that the attacker cannot fully control, the malformed message triggers a heap buffer over-read in the NGINX worker process, causing it to crash and restart - interrupting active MQTT connections for the duration of the respawn cycle. No data exfiltration, persistent access, or code execution is achievable through this path.