Use-After-Free Vulnerability in NGINX Plus and NGINX Open Source
CVE-2026-97205

9.2CRITICAL

Key Information:

Vendor

F5
Status
Nginx Plus
Nginx Open Source
Vendor
CVE Published:
14 October 2026

What is CVE-2026-97205?

A flaw exists in the ngx_http_core_module of NGINX Plus and NGINX Open Source, which can be exploited when asynchronous file I/O (AIO) is activated. In certain configurations, processing Server Side Includes (SSI) pages with 'include virtual' commands may lead to a Use-After-Free condition within the NGINX worker process. This could result in memory corruption or crashing of the worker process, hence potentially allowing attackers to execute arbitrary code on systems that lack Address Space Layout Randomization (ASLR) controls or where ASLR can be bypassed. The impact is primarily on the data plane, leading to possible denial-of-service scenarios.

Affected Version(s)

NGINX Open Source 1.31.0 < 1.31.7

NGINX Open Source 1.30.0 < 1.30.6

NGINX Plus 37.1.0 < 37.1.0.1

References

https://my.f5.com/manage/s/article/K000162608
vendor-advisory

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

F5 acknowledges Cyberlanc3r for bringing this issue to our attention and following the highest standards of coordinated disclosure.
.