Summary: F5 has issued a security advisory regarding a significant vulnerability in NGINX, tracked as CVE-2025-23419, which could enable unauthorized access to sensitive resources by bypassing client certificate authentication. The issue arises when name-based virtual hosts share the same IP address and port while using TLS 1.3. F5 recommends several mitigation measures to address the vulnerability in affected versions of NGINX.
Affected: NGINX Open Source and NGINX Plus
Keypoints :
- Vulnerability CVE-2025-23419 allows attackers to bypass client certificate authentication.
- Affects NGINX versions R28 – R33 for NGINX Plus and 1.11.4 – 1.27.31 for NGINX Open Source.
- Mitigation measures include using unique IP and port combinations for server blocks and disabling TLS 1.3 as a last resort.