Introduction
Unexpected service interruptions on F5 BIG-IP infrastructure can disrupt application delivery immediately, trigger failover events, and degrade the user experience. CVE-2025-53474 is a buffer overflow in the Traffic Management Microkernel (TMM) that specific iRule configurations can trigger. It exposes organizations to targeted denial of service, especially those running custom Node.js extensions.
About F5 Networks: F5 is a leading provider of application delivery controllers and security appliances, and its BIG-IP platform is widely deployed in enterprise, service provider, and cloud environments. Customers can extend BIG-IP through iRules and iRules LX. That extensibility is an important feature, and it also introduces complex attack surfaces.
Technical information
CVE-2025-53474 is a buffer overflow vulnerability (CWE-120) in the F5 BIG-IP Traffic Management Microkernel (TMM). The issue arises when a virtual server is configured with an iRule that uses the ILX::call command to invoke Node.js extensions through iRules LX. Under certain undisclosed traffic conditions, improper input validation lets data be copied into fixed-size buffers without adequate bounds checking. The overflow can corrupt memory, and it causes TMM to terminate unexpectedly. Service stops at once, and clustered deployments fail over.
The flaw sits in the communication path between TCL-based iRule execution in TMM and the Node.js extension process. The overflow occurs when data passed from the iRule to the extension (or from the extension back to the iRule) exceeds the expected buffer size. The root cause is missing input size validation during buffer copy operations, as described in CWE-120. No public code snippets or exploit details are available.
Affected systems and versions
- Products: F5 BIG-IP
- Component: Traffic Management Microkernel (TMM) with iRules using ILX::call (iRules LX)
- Affected Versions:
- Fixed in BIG-IP version 17.5.1.3 (release notes)
- Earlier versions are affected where iRules using ILX::call are configured
- Configuration: Only virtual servers with iRules that invoke Node.js extensions through ILX::call are affected. Default configurations and systems without iRules LX are not vulnerable.
Vendor security history
F5 has fixed multiple vulnerabilities in TMM before, including buffer overflows and denial-of-service conditions. Bug ID 884801-12, also fixed in 17.5.1.3, describes similar TMM crashes involving ILX::call. F5's quarterly security notifications and advisories provide timely information and patches for critical vulnerabilities. Custom code paths such as iRules LX have been a recurring source of security issues on BIG-IP, and they require careful configuration and prompt patching.
