F5-K000162098: Use After Free

Q: What conditions are required for exploitation?

SSI, proxy_pass, and proxy_buffering off must be configured. An unauthenticated attacker must also have man-in-the-middle capability to control responses from an upstream server.

Q: Are default deployments necessarily affected?

The issue is described as existing only with the specified SSI, proxy_pass, and proxy_buffering off configuration. The provided information does not state whether those settings are enabled by default in any affected product.

Q: What is the expected impact if exploitation succeeds?

Exploitation may allow limited modification of memory or cause an NGINX worker process restart. The vulnerability is a use-after-free in the ngx_http_ssi_module module.

Q: What can be checked while patching is pending?

Review NGINX configuration for simultaneous use of SSI, proxy_pass, and proxy_buffering off. Also assess whether an attacker could intercept and alter responses received from the upstream server.

Published Jul 15, 2026

Updated

NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpssimodule module. This vulnerability may exist when the Server-Side Includes (SSI), proxypass, and proxybuffering off directives are configured. With this configuration, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to cause a use-after-free in the NGINX worker process. This issue may lead to limited modification of memory or a restart of the NGINX worker process.

Affected Software

12 affected componentsFixes available

F5 NGINX Plus>=37.0.0.1<=37.0.2.1

37.0.3.1

F5 NGINX Plus=33

F5 NGINX Open Source=1.31.2, >=1.30.0<=1.30.3

1.31.31.30.4

F5 NGINX Instance Manager>=2.17.0<=2.22.1

2.22.2

F5 F5 WAF for NGINX>=5.9.0<=5.13.3

5.13.4

F5 NGINX App Protect WAF>=5.2.0<=5.8.0

F5 NGINX App Protect WAF>=4.11.0<=4.16.0

F5 NGINX Gateway Fabric>=2.0.0<=2.6.6

2.6.7

F5 NGINX Gateway Fabric>=1.3.0<=1.6.2

F5 NGINX Ingress Controller>=1<=2026, =2026, >=5.0.0<=5.5.2

2026-

F5 NGINX Ingress Controller>=4.0.0<=4.0.1

F5 NGINX Ingress Controller>=3.5.0<=3.7.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 37.0.3.1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 36
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.31.31.30.4
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.22.2
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.13.4
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.6.7
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2026-

Event History

Jul 15, 2026

Advisory Published

via F5·01:38 PM

Data Sourced

via F5·01:38 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What conditions are required for exploitation?

SSI, proxy_pass, and proxy_buffering off must be configured. An unauthenticated attacker must also have man-in-the-middle capability to control responses from an upstream server.

Are default deployments necessarily affected?

The issue is described as existing only with the specified SSI, proxy_pass, and proxy_buffering off configuration. The provided information does not state whether those settings are enabled by default in any affected product.

What is the expected impact if exploitation succeeds?

Exploitation may allow limited modification of memory or cause an NGINX worker process restart. The vulnerability is a use-after-free in the ngx_http_ssi_module module.

What can be checked while patching is pending?

Review NGINX configuration for simultaneous use of SSI, proxy_pass, and proxy_buffering off. Also assess whether an attacker could intercept and alter responses received from the upstream server.

F5-K000162098: Use After Free

Affected Software

Remediation

Event History

Frequently Asked Questions

What conditions are required for exploitation?

Are default deployments necessarily affected?

What is the expected impact if exploitation succeeds?

What can be checked while patching is pending?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required for exploitation?

Are default deployments necessarily affected?

What is the expected impact if exploitation succeeds?

What can be checked while patching is pending?