NGINX mail authentication denial of service (CVE-2026-27651)

Summary

Mail authentication requests may terminate NGINX worker processes.

Vulnerability ID	Vulnerability Overview
CVE-2026-27651	With ngx_mail_auth_http_module enabled, CRAM-MD5 or APOP authentication and retry responses containing Auth-Wait can expose a worker termination condition, causing denial of service.

Affected Supported TeraStations

TS5020 / TS3030
- Fixed in firmware version 3.16
 

 

Back to Security Notices

Date	Description
10/14/2026	Initial release

Back to Security Notices