NGINX MP4 processing memory corruption (CVE-2026-32647)

Summary

A crafted MP4 file may crash a worker or potentially execute code.

Vulnerability ID	Vulnerability Overview
CVE-2026-32647	With ngx_http_mp4_module and the mp4 directive enabled, processing a crafted MP4 file can cause worker memory over-reads or over-writes. The result may be worker termination or, under suitable conditions, code execution.

Affected Supported TeraStations

TS5020 / TS3030
- Fixed in firmware version 3.16
 

 

Back to Security Notices

Date	Description
10/14/2026	Initial release

Back to Security Notices