CVE-2026-56434: NGINX ngx_http_ssi_module vulnerability
Last updated 20 July 2026
Other sources
NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpssimodule module. This vulnerability may exist when the Server-Side Includes (SSI), proxypass, and proxybuffering off directives are configured. With this configuration, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to cause a use-after-free in the NGINX worker process. This issue may lead to limited modification of memory or a restart of the NGINX worker process.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/nginxto a version that resolves this vulnerability.Fixed in 1.30.1-7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.28.3-8 - Configuration
Avoid configuring the vulnerable combination that allows the issue to trigger: do not use Server-Side Includes (SSI) together with `proxy_pass` and `proxy_buffering off`.
NGINX ngx_http_ssi_module SSI / Server-Side Includes (SSI) = not configured/enabled as in the vulnerable combination - Configuration
If SSI and `proxy_pass` are used, ensure `proxy_buffering` is not set to `off` (the vulnerability is stated to exist when `proxy_buffering off` is configured alongside SSI and `proxy_pass`).
NGINX proxy_buffering = on (avoid `off`)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56434?
The severity of CVE-2026-56434 is rated as medium with a score of 6.5.
What systems are affected by CVE-2026-56434?
CVE-2026-56434 affects NGINX Plus and NGINX Open Source when certain configurations are in use.
How do I fix CVE-2026-56434?
To fix CVE-2026-56434, review and adjust the configuration of Server-Side Includes, proxy_pass, and proxy_buffering directives.
What type of attack can exploit CVE-2026-56434?
CVE-2026-56434 can be exploited by an unauthenticated attacker using man-in-the-middle (MITM) techniques.
What is the nature of the vulnerability in CVE-2026-56434?
CVE-2026-56434 is categorized as a Use After Free vulnerability within the ngx_http_ssi_module.