CVE-2026-97205: NGINX ngx_http_core_module vulnerability
NGINX ngxhttpcoremodule vulnerability
Other sources
NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpcoremodule module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
— Ubuntu
NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpcoremodule module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing include virtual commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or cause a worker process to terminate unexpectedly. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.
— F5
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/nginxto a version that resolves this vulnerability.Fixed in 1.26.3-3+deb13u10Fixed in 1.30.6-2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 37.1.0.137.0.5.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.31.71.30.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.24.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.16.05.14.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.11.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.8.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.7.0 - Upgrade
Upgrade
azurelinux/nginxto a version that resolves this vulnerability.Fixed in 1.30.6-1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
NGINX Plus and NGINX Open Source deployments are affected when asynchronous file I/O is enabled in a susceptible configuration and SSI pages containing “include virtual” commands are processed. The issue affects the data plane only; there is no control-plane exposure.
What does an attacker need to exploit it?
An attacker must be able to trigger processing of an SSI page that contains “include virtual” commands in a deployment where AIO is enabled in the relevant configuration. No authentication or user interaction is required according to the supplied vector.
What is the likely impact if exploitation succeeds?
Exploitation may crash an NGINX worker process, corrupt memory, or cause denial of service. Code execution may be possible where ASLR is disabled or the attacker can bypass ASLR.
What should teams check while evaluating exposure?
Check whether AIO is enabled and whether the server processes SSI content containing “include virtual” commands. Also determine whether ASLR is disabled, since that increases the stated code-execution risk.