CVE-2026-97205 in Plus
Summary
by MITRE • 10/14/2026
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.
Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The identified vulnerability resides within the ngx_http_core_module of both NGINX Plus and NGINX Open Source, specifically affecting configurations where asynchronous file I/O is enabled. This flaw manifests when the server processes Server Side Includes pages that contain include virtual commands. The core technical issue is a Use-After-Free condition in the worker process memory management logic. When an attacker sends a crafted request triggering this specific SSI processing path with AIO active, the software fails to properly manage the lifecycle of certain memory buffers or structures associated with the asynchronous operation. This leads to the application attempting to access memory that has already been freed by the system, resulting in undefined behavior within the worker process context.
From a security impact perspective, this vulnerability presents multiple severe risks depending on the target environment's configuration and defenses. The most immediate consequence is a denial of service, as the use-after-free condition can cause the NGINX worker process to crash unexpectedly. This disrupts all traffic routed through that specific worker, potentially taking down services if no redundant workers are available or if the master process fails to restart the worker correctly in time. Beyond availability, the memory corruption aspect poses a significant threat to data integrity and system stability. In environments where Address Space Layout Randomization is disabled, or where an attacker has successfully bypassed ASLR through other means, this vulnerability can be leveraged for remote code execution. By carefully crafting the input to control the state of freed memory, an attacker may overwrite function pointers or return addresses, thereby gaining arbitrary code execution privileges on the host system running NGINX.
This incident is classified under CWE-416, Use After Free, which describes situations where a pointer references memory that has been deallocated and subsequently reallocated for another purpose without proper validation. The attack vector aligns with MITRE ATT&CK technique T1203, Exploitation for Client Execution, as it involves delivering malicious input via standard HTTP requests to exploit client-side or server-side processing logic. It is important to note that this vulnerability affects the data plane exclusively and does not expose any control plane interfaces. This means that exploitation requires direct interaction with the web service itself rather than compromising administrative APIs or management consoles. The absence of control plane exposure limits the initial attack surface but does not diminish the severity of the potential outcomes, particularly regarding system compromise in poorly secured environments.
Mitigation strategies must focus on immediate configuration changes and software updates to address this critical flaw. Administrators should prioritize upgrading NGINX Open Source and NGINX Plus to versions that include patches for this specific issue. If an upgrade is not immediately feasible, a temporary workaround involves disabling asynchronous file I/O in the nginx.conf configuration by setting aio off within the relevant server or location blocks. This prevents the triggering condition from occurring but may impact performance characteristics dependent on AIO features. Additionally, ensuring that Address Space Layout Randomization remains enabled and up to date on all operating systems running NGINX provides a crucial layer of defense against code execution attempts derived from this vulnerability. Regular security audits and monitoring for unusual worker process restarts or memory errors can also aid in early detection of exploitation attempts before significant damage occurs.