CVE-2026-97205

Use-after-free in NGINX when AIO and SSI are enabled

CVSS 4.0: 9.2 critical
EPSS: —
Published: Oct 14, 2026 · 11d ago
Modified: Oct 15, 2026

Analyze CVE-2026-97205 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

NGINX Open Source and NGINX Plus have a use-after-free (CWE-416) in ngx_http_core_module when asynchronous file I/O (AIO) is enabled and a Server Side Includes page containing “include virtual” is processed. A remote attacker who can cause the worker to handle such a page may free memory that is still used, corrupting worker memory or crashing the worker (denial of service). On systems where ASLR is disabled, or where the attacker can bypass ASLR, the same flaw may allow code execution in the worker; there is no control-plane exposure. Only deployments that actually enable AIO in the affected configuration and serve SSI includes are at risk, and End of Technical Support versions were not evaluated. It is not on the CISA KEV list and no public proof-of-concept is known.

What to do: Treat this as a data-plane issue only: identify workers with asynchronous file I/O (AIO) enabled and SSI pages that use “include virtual,” and disable AIO or stop serving those SSI includes until F5 ships a fix. Keep ASLR enabled. Apply the vendor patch for supported NGINX Open Source and NGINX Plus as soon as it is published; End of Technical Support releases were not evaluated and should not be assumed safe.

Product	Affected
F5 NGINX Open Source	—
F5 NGINX Plus	—

Estimated exposure

largeUnknown exact count; subset of tens of millions of NGINX deployments that enable AIO with SSI include virtual — NGINX is one of the most widely deployed web servers (on the order of tens of millions of sites by public market-share surveys), but the bug requires a non-default combination of AIO plus SSI “include virtual,” so only a subset of those…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Weakness: CWE-416

Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

NVD CVE.org GitHub PoCs EPSS (—)