Updating NGINX for Vulnerabilities in the MP4 and HLS Video-Streaming Modules

Prabhat Dixit Thumbnail
Prabhat Dixit
Published October 19, 2022

Today, we are releasing updates to NGINX Plus, NGINX Open Source, NGINX Open Source Subscription, and NGINX Ingress Controller in response to recently discovered vulnerabilities in the NGINX modules for video streaming with the MP4 and Apple HTTP Live Streaming (HLS) formats, ngx_http_mp4_module and ngx_http_hls_module. (NGINX Open Source Subscription is a specially packaged edition of NGINX Open Source available in certain geographies.)

The vulnerabilities have been registered in the Common Vulnerabilities and Exposures (CVE) database and the F5 Security Incident Response Team (F5 SIRT) has assigned scores to them using the Common Vulnerability Scoring System (CVSS v3.1) scale.

The following vulnerabilities in the MP4 module (ngx_http_mp4_module) apply to NGINX Plus, NGINX Open Source, and NGINX Open Source Subscription.

The following vulnerability in the HLS module (ngx_http_hls_module) applies to NGINX Plus only.

Patches for these vulnerabilities are included in the following software versions:

  • NGINX Plus R27 P1
  • NGINX Plus R26 P1
  • NGINX Open Source 1.23.2 (mainline)
  • NGINX Open Source 1.22.1 (stable)
  • NGINX Open Source Subscription R2 P1
  • NGINX Open Source Subscription R1 P1
  • NGINX Ingress Controller 2.4.1
  • NGINX Ingress Controller 1.12.5

All versions of NGINX Plus, NGINX Open Source, NGINX Open Source Subscription, and NGINX Ingress Controller are affected. We strongly recommend that you upgrade your NGINX software to the latest version.

For NGINX Plus upgrade instructions, see Upgrading NGINX Plus in the NGINX Plus Admin Guide. NGINX Plus customers can also contact our support team for assistance at

"This blog post may reference products that are no longer available and/or no longer supported. For the most current information about available F5 NGINX products and solutions, explore our NGINX product family. NGINX is now part of F5. All previous links will redirect to similar NGINX content on"