CVE-2026-56434: NGINX ngx_http_ssi_module vulnerability
Last updated 20 July 2026
Other sources
NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpssimodule module. This vulnerability may exist when the Server-Side Includes (SSI), proxypass, and proxybuffering off directives are configured. With this configuration, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to cause a heap buffer over-read in the NGINX worker process. This issue may lead to limited modification of memory or a restart of the NGINX worker process.
Impact: This vulnerability may allow remote attackers to have limited control to modify memory contents or restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
— Red Hat
NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpssimodule module. This vulnerability may exist when the Server-Side Includes (SSI), proxypass, and proxybuffering off directives are configured. With this configuration, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to cause a use-after-free in the NGINX worker process. This issue may lead to limited modification of memory or a restart of the NGINX worker process.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/nginxto a version that resolves this vulnerability.Fixed in 1.30.1-7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.28.3-8 - Compensating control
If you are using NGINX ngx_http_ssi_module, avoid configurations where the Server-Side Includes (SSI), proxy_pass, and proxy_buffering off directives are all enabled together, because this is the configuration in which an attacker with MITM control over upstream responses may trigger heap buffer over-read or use-after-free leading to a restart or limited memory modification in the NGINX worker process.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56434?
The severity of CVE-2026-56434 is rated as medium with a score of 6.5.
What systems are affected by CVE-2026-56434?
CVE-2026-56434 affects NGINX Plus and NGINX Open Source when certain configurations are in use.
How do I fix CVE-2026-56434?
To fix CVE-2026-56434, review and adjust the configuration of Server-Side Includes, proxy_pass, and proxy_buffering directives.
What type of attack can exploit CVE-2026-56434?
CVE-2026-56434 can be exploited by an unauthenticated attacker using man-in-the-middle (MITM) techniques.
What is the nature of the vulnerability in CVE-2026-56434?
CVE-2026-56434 is categorized as a Use After Free vulnerability within the ngx_http_ssi_module.