CVE-2022-41742

score

<0.1

cvss

7.1

epss

1.2%

published

2022-10-19

kev added

—

first seen

2026-10-21

NGINX Open Source before 1.23.2, 1.22.1, NGINX Subscription before R2 P1, R1 P1, and NGINX Plus before R27 P1, R26 P1 contain a worker process crash and memory disclosure vulnerability caused by processing specially crafted audio or video files with the ngx_http_mp4_module when the mp4 directive is used, letting local attackers cause denial of service or memory disclosure, exploit requires triggering processing of malicious media files.