High priorityDisclosed

Advisory · CVE-2026-97205

Use-after-free in NGINX AIO and SSI handling can corrupt worker memory

NGINX Plus and NGINX Open Source have a vulnerability in ngx_http_core_module: when asynchronous file I/O is enabled in certain configurations, processing a Server Side Includes page containing include virtual commands may trigger a use-after-free in the worker process, causing memory corruption or a crash, and possibly code execution where ASLR is disabled or bypassed. F5 rates it CVSS 3.1 8.1 (CVSS 4.0 9.2).

Advisory published October 14, 2026Independent summary
Vendor
F5
Product
NGINX Plus and NGINX Open Source
Identifier / CWE
CVE-2026-97205
CWE-416
Action timing
Immediate
ELI5

Explain it like I’m five

An old templating feature plus async file I/O leaves the worker using memory it already gave back.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Crafted request arrives

    An attacker sends HTTP requests shaped to reach the affected NGINX configuration path.

  2. 02Worker memory corrupted or check bypassed

    The flaw takes effect in the NGINX worker or ingress data plane.

  3. 03Impact lands

    The attacker gains the access, crash, or code execution the flaw allows.

What happened

F5 disclosed CVE-2026-97205 for NGINX Plus and NGINX Open Source. With AIO enabled in certain configurations, processing an SSI page containing include virtual commands may trigger a use-after-free in the NGINX worker process, leading to memory corruption, a worker crash, or possibly code execution where ASLR is disabled or bypassed. F5 lists NGINX Open Source 1.31.0 before 1.31.7 and the 1.30 line before 1.30.6, plus NGINX Plus 37.x and R33 through R36 lines, as affected.

F5’s K000162608 lists the affected versions and the fixed builds. Match your deployment to the article before changing anything.

What to do

  1. Inventory every NGINX Plus and NGINX Open Source deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to NGINX Plus and NGINX Open Source while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for NGINX worker crashes on sites using SSI include virtual with AIO enabled, and SSI pages with unusual include patterns.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

SSI is legacy in many estates and forgotten in most inventories. Patch NGINX, and check whether SSI and AIO are even still needed.