Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.2

NGINX may crash or be hijacked via crafted SSI page

CVE-2026-97205 · published 1 day ago
Summary

Both NGINX Plus and NGINX Open Source can crash or become vulnerable to code execution when asynchronous file I/O is turned on and a Server Side Includes page uses "include virtual" commands. The problem can corrupt memory, stop a worker process, or let an attacker run code if system protections are weak. Update to the latest NGINX release or disable asynchronous file I/O for SSI pages to protect your servers.

What to do
  • Update f5 nginx plus to version 37.1.0.1 or later.
  • Update f5 nginx open source to version 1.31.7 or later.
Affected software
Ecosystem VendorProductAffected versions
– f5 nginx plus < 37.1.0.1
– f5 nginx open source < 1.31.7
Debian:12 debian nginx All versions
Original advisory text
NGINX ngx_http_core_module vulnerability
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.

Impact:
This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only.




Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.2 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-416Use After Free
Timeline
Published14 Oct 2026
Updated15 Oct 2026
First seen14 Oct 2026
Sources
CVE-2026-97205 · NVD
CVE-2026-97205 · MITRE
DEBIAN-CVE-2026-97205 · OSV
Track software like this
Free during beta