Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

nginx can crash or be hijacked via SSI includes

published 21 days ago
Summary

Both NGINX Plus and the open‑source version can crash or let an attacker run code when asynchronous file handling is turned on and a page uses SSI "include virtual" commands. The problem shows up as a memory error that may stop the worker process or, in rare cases, allow code execution if security protections are weak. Upgrade to version 1.30.6-1 or later, or disable asynchronous I/O or SSI includes until you can apply the update.

What to do
  • Update nginx to version 1.30.6-1.
Affected software
Ecosystem VendorProductAffected versions
Azure Linux:3 – nginx < 1.30.6-1
Fix: upgrade to 1.30.6-1
Azure Linux:3 azure nginx <= 1.30.4-1
Original advisory text
CVE-2026-97205 affecting package nginx for versions less than 1.30.6-1
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.

Impact:
This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only.




Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
References
Timeline
Published14 Oct 2026
Updated2 Nov 2026
First seen17 Oct 2026
Sources
AZL-108443 · OSV
Track software like this
Free during beta