CVE-2026-97205: NGINX ngx_http_core_module vulnerability

Published Oct 14, 2026

Updated

NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpcoremodule module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.

Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected Software

2 affected components

Nginx NGINX Plus

Nginx NGINX Open Source

Event History

Oct 14, 2026

CVE Published

via MITRE·02:40 PM

Data Sourced

via MITRE·02:40 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

NGINX Plus and NGINX Open Source deployments are affected when asynchronous file I/O is enabled in a susceptible configuration and SSI pages containing “include virtual” commands are processed. The issue affects the data plane only; there is no control-plane exposure.

What does an attacker need to exploit it?

An attacker must be able to trigger processing of an SSI page that contains “include virtual” commands in a deployment where AIO is enabled in the relevant configuration. No authentication or user interaction is required according to the supplied vector.

What is the likely impact if exploitation succeeds?

Exploitation may crash an NGINX worker process, corrupt memory, or cause denial of service. Code execution may be possible where ASLR is disabled or the attacker can bypass ASLR.

What should teams check while evaluating exposure?

Check whether AIO is enabled and whether the server processes SSI content containing “include virtual” commands. Also determine whether ASLR is disabled, since that increases the stated code-execution risk.