CVE-2026-40701: NGINX ngx_http_ssl_module vulnerability

Description

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the ssl_verify_client directive is set to "on" or "optional," and the ssl_ocsp directive is set to "on" or the leaf parameters are configured with a resolver. With this configuration, an unauthenticated attacker can send requests along with conditions beyond its control that may cause a heap-use-after-free error in the NGINX worker process. This vulnerability may result in limited modification of data or the NGINX worker process restarting. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

Attack vector

Network

Complexity

High

Privileges

None

User interaction

None

Confidentiality

Low

Integrity

None

Availability

Low

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.7% · higher than 53% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

NO

NGINX Open Source · F5

1.19.0 before 1.30.1 · source: vendor, NVD

NP

NGINX Plus · F5

R36 before R36 P4; R32 before R32 P6 · source: vendor, NVD

DO

Dos · F5

4.3.0 through 4.7.0; 4.8.0 · source: NVD

NG

Nginx Gateway Fabric · F5

1.3.0 through 1.6.2; 2.0.0 through 2.6.0 · source: NVD

NI

Nginx Ingress Controller · F5

3.5.0 through 3.7.2; 4.0.0 through 4.0.1; 5.0.0 through 5.4.2 · source: NVD

NI

Nginx Instance Manager · F5

2.16.0 through 2.22.0 · source: NVD

WA

Waf · F5

4.9.0 through 4.16.0; 5.1.0 through 5.8.0; 5.9.0 through 5.12.1 · source: NVD