CVE-2026-97205

Awaiting Analysis Awaiting Analysis - Queue

Use-After-Free in NGINX Plus and NGINX Open Source

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: F5 Networks

Description

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-97205

EUVD

EUVD-2026-101115

Affected Vendors & Products

Vendor	Product	Version / Range
F5	NGINX	Plus 37.1.0
F5	NGINX	Plus 37.0.0
F5	NGINX	Plus R36
F5	NGINX	Plus R35
F5	NGINX	Plus R34
F5	NGINX	Plus R33
F5	NGINX	Open Source 1.31.0
F5	NGINX	Open Source 1.30.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability exists in NGINX Plus and NGINX Open Source due to a flaw in the ngx_http_core_module. When asynchronous file I/O (AIO) is enabled and certain configurations are used, processing a Server Side Includes (SSI) page with 'include virtual' commands may cause a Use-After-Free (UAF) in the NGINX worker process. This can lead to memory corruption or worker process crashes. Attackers can exploit this to execute code if ASLR is disabled or bypassed.

Detection Guidance

To detect this vulnerability, check if NGINX is running with AIO enabled and SSI processing active. Inspect NGINX configuration files for 'aio on;' and 'ssi on;' directives. Monitor worker process crashes or memory corruption errors in logs. Use 'nginx -t' to validate configurations and 'ps aux | grep nginx' to check running processes.

Impact Analysis

This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly execute arbitrary code. It only affects the data plane, not the control plane, meaning it impacts web traffic handling but not administrative functions.

Compliance Impact

This vulnerability primarily causes denial-of-service, memory corruption, or potential code execution on affected NGINX systems. It does not directly impact data confidentiality or integrity but may lead to service disruptions that could affect compliance with standards requiring high availability or data protection.

Mitigation Strategies

Disable AIO in NGINX configuration by removing the 'aio' directive from the http, server, or location blocks. Disable SSI processing if not required by removing 'ssi on' from configurations. Restart NGINX to apply changes.

Hi! I’m here to help you understand CVE-2026-97205. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70