Vulnerability · Published Aug 13, 2025 · Assigned by f5
CVE-2025-53859NGINX ngx_mail_smtp_module vulnerability
Low 3.7
In plain English
A low-severity out-of-bounds read in NGINX Open Source from F5. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
NGINX Open Source and NGINX Plus have a vulnerability in the ngx_mail_smtp_module that might allow an unauthenticated attacker to over-read NGINX SMTP authentication process memory; as a result, the server side may leak arbitrary bytes sent in a request to the authentication server. This issue happens during the NGINX SMTP authentication process and requires the attacker to make preparations against the target system to extract the leaked data. The issue affects NGINX only if (1) it is built with the ngx_mail_smtp_module, (2) the smtp_auth directive is configured with method "none," and (3) the authentication server returns the "Auth-Wait" response header. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.22 | nginx | 1.28.2-r0 | ALPINE-CVE-2025-53859 |
| Alpine:v3.23 | nginx | 1.28.2-r0 | ALPINE-CVE-2025-53859 |
| Alpine:v3.24 | nginx | 1.28.2-r0 | ALPINE-CVE-2025-53859 |
| Debian:12 | nginx | 1.22.1-9+deb12u3 | DEBIAN-CVE-2025-53859 |
| Debian:13 | nginx | 1.26.3-3+deb13u1 | DEBIAN-CVE-2025-53859 |
| Debian:14 | nginx | 1.28.0-3 | DEBIAN-CVE-2025-53859 |
| Ubuntu:22.04:LTS | nginx | 1.18.0-6ubuntu14.7 | USN-7715-1 |
| Ubuntu:22.04:LTS | nginx | 1.18.0-6ubuntu14.7 | UBUNTU-CVE-2025-53859 |
| Ubuntu:24.04:LTS | nginx | 1.24.0-2ubuntu7.5 | USN-7715-1 |
| Ubuntu:24.04:LTS | nginx | 1.24.0-2ubuntu7.5 | UBUNTU-CVE-2025-53859 |
| Ubuntu:25.10 | nginx | 1.26.3-3ubuntu3 | UBUNTU-CVE-2025-53859 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| F5 | NGINX Plus | R34 – before R34 P2R33 – before R33 P3R32 – before R32 P3R31 – before *R30 – before * |
| F5 | NGINX Open Source | 0.7 – before 1.29.1 |
Weakness: CWE-125 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N