CVE-2026-56434

Awaiting Analysis Awaiting Analysis - Queue

Heap Buffer Over-Read in NGINX Plus and Open Source

Publication date: 2026-07-15

Last updated on: 2026-07-15

Assigner: F5 Networks

Description

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module. This vulnerability may exist when the Server-Side Includes (SSI), proxy_pass, and proxy_buffering off directives are configured. With this configuration, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to cause a use-after-free in the NGINX worker process. This issue may lead to limited modification of memory or a restart of the NGINX worker process. Impact: This vulnerability may allow remote attackers to have limited control to modify memory contents or restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-15

Generated

2026-08-04

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-03

NVD

CVE-2026-56434

EUVD

EUVD-2026-44684

Affected Vendors & Products

Vendor	Product	Version / Range
nginx	nginx_plus	*
nginx	nginx_open_source	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability affects NGINX Plus and NGINX Open Source when using the ngx_http_ssi_module with proxy_pass and proxy_buffering off directives. An unauthenticated attacker with MITM capabilities controlling upstream responses could trigger a use-after-free in the NGINX worker process, potentially modifying memory or restarting the worker process.

Detection Guidance

This vulnerability requires specific NGINX configurations (SSI, proxy_pass, and proxy_buffering off) and a MITM attacker controlling upstream responses. Detection involves checking NGINX configurations for these directives and monitoring for unexpected worker process restarts or memory corruption events.

Impact Analysis

This vulnerability allows remote attackers to modify memory contents or restart the NGINX worker process. It does not expose the control plane but affects the data plane, potentially disrupting services or causing instability in NGINX operations.

Compliance Impact

This vulnerability may allow remote attackers to modify memory or restart NGINX worker processes, which could disrupt service availability or integrity. Such disruptions may impact compliance with standards requiring data integrity and availability, such as GDPR and HIPAA, depending on deployment context.

Mitigation Strategies

Disable the ngx_http_ssi_module if not needed. Ensure proxy_buffering is enabled. Update NGINX to a patched version if available. Monitor worker process crashes as an indicator of exploitation.

Hi! I’m here to help you understand CVE-2026-56434. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70