CVE-2025-53859: f5 nginx open source Out-of-bounds Read
Vulnerability summary
CVE-2025-53859 is a medium (CVSS 6.3) Out-of-bounds Read vulnerability in f5 nginx open source. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 34.1% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1 · Related 2Timeline
- 13-08-2025PublishedVulnerability first disclosed.
- 04-11-2025Last modifiedVulnerability information updated.
Description
NGINX Open Source and NGINX Plus have a vulnerability in the ngx_mail_smtp_module that might allow an unauthenticated attacker to over-read NGINX SMTP authentication process memory; as a result, the server side may leak arbitrary bytes sent in a request to the authentication server. This issue happens during the NGINX SMTP authentication process and requires the attacker to make preparations against the target system to extract the leaked data. The issue affects NGINX only if (1) it is built with the ngx_mail_smtp_module, (2) the smtp_auth directive is configured with method "none," and (3) the authentication server returns the "Auth-Wait" response header. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS metrics
10 scores · 7 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated6.3MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · UbuntuEcosystem advisory · calculated6.3MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- OSV · DebianEcosystem advisory · calculated6.3MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · WolfiEcosystem advisory · calculated6.3MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · ChainguardEcosystem advisory · calculated6.3MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- NVDNIST6.3MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · UbuntuEcosystem advisory · calculated3.7LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- NVDNIST3.7LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
0.41%
Chance of exploitation in the next 30 days
Percentile
34%
Versus all other CVEs
30-day change
+0.02 pp
From 0.39% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard17 products
- nginx-stable< 1.30.0-r0
- nginx-stable-config< 1.30.0-r0
- nginx-stable-config-compat< 1.30.0-r0
- nginx-stable-fastcgi-params< 1.30.0-r0
- nginx-stable-mime-types< 1.30.0-r0
Wolfi17 products
- nginx-stable< 1.30.0-r0
- nginx-stable-config< 1.30.0-r0
- nginx-stable-config-compat< 1.30.0-r0
- nginx-stable-fastcgi-params< 1.30.0-r0
- nginx-stable-mime-types< 1.30.0-r0
F52 products
- nginx open source≥ 0.7, < 1.29.1 | ≥ 0.7.22, < 1.29.1
- nginx plus≥ R34, < R34 P2 | ≥ R33, < R33 P3 | ≥ R32, < R32 P3 | ≥ R31 (No fix recorded) | ≥ R30 (No fix recorded) | r30 | r31 | r32 | r32:p1 | r32:p2 | r33 | r33:p1 | r33:p2 | r34 | r34:p1
Alpine1 product
- nginx< 1.28.2-r0
Debian1 product
- nginx< 1.22.1-9+deb12u3 | < 1.26.3-3+deb13u1 | < 1.28.0-3
Mageia1 product
- nginx< 1.26.3-1.1.mga9
Opensuse1 product
- nginx&distro=openSUSE Tumbleweed< 1.29.1-1.1
Ubuntu1 product
- nginx< 1.4.6-1ubuntu3.9+esm6 | < 1.10.3-0ubuntu0.16.04.5+esm7 | < 1.14.0-0ubuntu1.11+esm2 | < 1.18.0-0ubuntu1.7+esm1 | < 1.26.3-3ubuntu3 | < 1.18.0-6ubuntu14.7 | < 1.24.0-2ubuntu7.5
8 vendors · 41 products
