NGINX 32-bit MP4 processing buffer overflow (CVE-2026-27784)

Summary

A crafted MP4 file may corrupt memory in a 32-bit NGINX worker.

Vulnerability ID	Vulnerability Overview
CVE-2026-27784	The 32-bit ngx_http_mp4_module implementation may read or write beyond worker memory when processing a crafted MP4 file. The module and mp4 directive must be enabled, and the attacker must be able to trigger processing of the file.

Affected Supported TeraStations

TS5020 / TS3030
- Fixed in firmware version 3.16
 

 

Back to Security Notices

Date	Description
10/14/2026	Initial release

Back to Security Notices