Read the docs
TI-2026-74062 Aliases CVE-2026-97205GHSA-ff5w-vvxc-fm9x

Use-after-free in NGINX ngx_http_core_module can crash workers

Priority MEDIUM 43CWE-416Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 1 fixed, 3 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-416 and the CVSS impact.

Summary

NGINX Plus from 37.0.0 before 37.0.5.1 and from 37.1.0 before 37.1.0.1, and NGINX Open Source from 1.30.0 before 1.30.6 and from 1.31.0 before 1.31.7, are affected. When asynchronous file I/O is enabled in certain configurations, processing a Server Side Includes page with include virtual commands triggers a use-after-free (CWE-416) in the worker process. A remote attacker without privileges or user interaction can crash the worker or corrupt its memory, and may execute code where ASLR is disabled or bypassed.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00834 57th percentileScored 2026-11-07
Fix Partial NGINX Plus (F5): 37.1.0.1, 37.0.5.1NGINX Open Source (F5): 1.31.7, 1.30.6Red Hat: 1 advisoryRed Hat: 1 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
F5NGINX Plus37.1.0 to before 37.1.0.1; 37.0.0 to before 37.0.5.1; R36 and later; R35 and later; R34 and later; R33 and later37.1.0.1, 37.0.5.1Patch availableCNA
F5NGINX Open Source1.31.0 to before 1.31.7; 1.30.0 to before 1.30.61.31.7, 1.30.6Patch availableCNA
  • NGINX Plus VendorF5 Affected 37.1.0 to before 37.1.0.1; 37.0.0 to before 37.0.5.1; R36 and later; R35 and later; R34 and later; R33 and later Fixed in 37.1.0.1, 37.0.5.1 Patch available CNA
  • NGINX Open Source VendorF5 Affected 1.31.0 to before 1.31.7; 1.30.0 to before 1.30.6 Fixed in 1.31.7, 1.30.6 Patch available CNA

Remediation

Upgrade NGINX Plus to 37.0.5.1 or 37.1.0.1 and NGINX Open Source to 1.30.6 or 1.31.7. Red Hat fixes Red Hat Hardened Images through RHSA-2026:83427 and lists no available fix plan for Red Hat Enterprise Linux 8, 9 and 10.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA NGINX Plus (F5) Fixed in 37.1.0.1, 37.0.5.1
  • Fix · CNA NGINX Open Source (F5) Fixed in 1.31.7, 1.30.6

Red Hat 1 advisory

  • RHSA-2026:83427 Released 2026-10-15 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images nginx-1.30.6-1.hum1@aarch64, nginx-1.30.6-1.hum1@s390x, nginx-1.30.6-1.hum1@src +34

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    F5 NGINX Open Source 1.30.6, 1.31.7

    5 records Highest priority Priority MEDIUM 3 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-74056 Heap buffer overflow in NGINX map directive regex matchingPriority MEDIUM 44
    • TI-2026-73990 Heap buffer overflow in NGINX alias and rewrite handlingPriority MEDIUM 44
    • TI-2026-74063 Forged SSL sessions in NGINX let attackers bypass client certificatesPriority LOW 36
    Show all 5 records →
  • Release ·

    F5 NGINX Plus 37.0.5.1, 37.1.0.1

    4 records Highest priority Priority MEDIUM 3 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-74056 Heap buffer overflow in NGINX map directive regex matchingPriority MEDIUM 44
    • TI-2026-73990 Heap buffer overflow in NGINX alias and rewrite handlingPriority MEDIUM 44
    • TI-2026-74063 Forged SSL sessions in NGINX let attackers bypass client certificatesPriority LOW 36
    Show all 4 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Hardened ImagesFixed RHSA-2026:83427

Timeline

  1. 2026-10-14 Threatist record created from CVE-2026-97205
  2. 2026-10-14 Alias added: GHSA-ff5w-vvxc-fm9x
  3. 2026-10-15 CISA SSVC decision points changed
  4. 2026-10-15 Priority changed: MEDIUM → LOW
  5. 2026-10-16 Priority changed: LOW → MEDIUM
  6. 2026-10-16 Fix available: RHSA-2026:83427 · Red Hat
  7. 2026-10-16 Fix available: Red Hat Hardened Images · Red Hat
  8. 2026-10-16 CVSS score added · Red Hat
  9. 2026-10-25 EPSS moved to the 50th–90th percentile

References

Advisory 1

  • TI-2023-25230 BIG-IP Configuration utility unauthenticated remote code execution vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-01269 Missing authentication in F5 BIG-IP KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-05850 Memory corruption in BIG-IP KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-05845 Server-side request forgery in BIG-IP; BIG-IQ KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-04820 Path traversal in BIG-IP KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
See all 1057 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences