Loading vulnerability…
AIO and SSI Use-After-Free in NGINX
CVE-2026-97205 is a use-after-free vulnerability in ngx_http_core_module affecting NGINX Plus, NGINX Open Source, and products incorporating vulnerable NGINX components. In certain non-default configurations with asynchronous file I/O (AIO) and Server Side Includes (SSI) enabled, processing SSI pages containing include virtual commands can overflow a counter tracking pending asynchronous operations. This can cause request memory to be freed while still in use by an NGINX worker process, resulting in memory corruption or a worker crash. Remote code execution may be possible if Address Space Layout Randomization (ASLR) is disabled or bypassed. The vulnerability affects the data plane only, with no control-plane exposure.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Unauthenticated remote attackers can cause memory corruption or terminate NGINX worker processes, resulting in denial of service. Successful code execution could compromise the confidentiality, integrity, and availability of resources accessible to the worker process, but requires ASLR to be disabled or bypassed. ASLR reduces the feasibility of reliable code execution but does not eliminate the underlying memory-corruption or denial-of-service risk.
If you can’t patch tonight, do this now.
Disable either AIO or SSI in every applicable HTTP, server, and location context. Set aio off; instead of aio on; or aio threads;, or remove the directive because off is the default. Alternatively, set ssi off; or remove ssi on;. Inspect included configurations and effective settings with nginx -T to ensure neither inheritance nor overrides re-enable the feature. Validate with nginx -t and reload with nginx -s reload. Test operational effects: disabling AIO can reduce static-file or media-serving performance, while disabling SSI stops include processing and may expose unprocessed SSI tags in HTML. Keep ASLR enabled as defense in depth; it is not a substitute for patching or disabling the vulnerable feature combination.
Patch, then assume compromise.
Upgrade to an applicable vendor-fixed release: NGINX Open Source 1.30.6 or 1.31.7; NGINX Plus 37.0.5.1 or 37.1.0.1; NGINX Instance Manager 2.24.0; F5 WAF for NGINX 5.14.2 or 5.16.0; F5 DoS for NGINX 4.11.0; NGINX Gateway Fabric 2.8.0; or NGINX Ingress Controller 5.7.0. Later releases within the corresponding fixed branch also contain the fix. For branches without a listed fix, migrate to a release containing the correction. Distribution-managed installations should apply their distribution's security update rather than rely solely on upstream version comparisons. Debian 13 is fixed in 1.26.3-3+deb13u10; Ubuntu fixes are 1.18.0-6ubuntu14.22 for 22.04 LTS, 1.24.0-2ubuntu7.19 for 24.04 LTS, 1.28.3-2ubuntu1.12 for 26.04 LTS, and 1.30.4-7ubuntu1.1 for 26.10.
No validated public exploits yet. Hidden: 2 rejected by Mallory's analysis as not a working exploit.
62 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.