CVE-2026-97205
Fixed in a distro release EPSS <1%CVSS 8.1
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Products: F5 NGINX Plus, F5 NGINX Open Source
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.24 | nginx | 1.30.6-r0 |
| Amazon Linux 2023 | nginx | 1:1.30.6-1.amzn2023.0.1 |
| Amazon Linux 2023 | nginx-all-modules | 1:1.30.6-1.amzn2023.0.1 |
| Amazon Linux 2023 | nginx-core | 1:1.30.6-1.amzn2023.0.1 |
| Amazon Linux 2023 | nginx-filesystem | 1:1.30.6-1.amzn2023.0.1 |
| Amazon Linux 2023 | nginx-mod-devel | 1:1.30.6-1.amzn2023.0.1 |
| Amazon Linux 2023 | nginx-mod-http-image-filter | 1:1.30.6-1.amzn2023.0.1 |
| Amazon Linux 2023 | nginx-mod-http-perl | 1:1.30.6-1.amzn2023.0.1 |
| Amazon Linux 2023 | nginx-mod-http-xslt-filter | 1:1.30.6-1.amzn2023.0.1 |
| Amazon Linux 2023 | nginx-mod-mail | 1:1.30.6-1.amzn2023.0.1 |
| Amazon Linux 2023 | nginx-mod-stream | 1:1.30.6-1.amzn2023.0.1 |
| Debian 12 | nginx | no fix |
| Debian 13 | nginx | 1.26.3-3+deb13u10 |
| Debian 14 | nginx | 1.30.4-8 |
| Red Hat hummingbird 1 | nginx | 0:1.30.6-1.hum1 |
| Red Hat hummingbird 1 | nginx-all-modules | 0:1.30.6-1.hum1 |
| Red Hat hummingbird 1 | nginx-core | 0:1.30.6-1.hum1 |
| Red Hat hummingbird 1 | nginx-filesystem | 0:1.30.6-1.hum1 |
| Red Hat hummingbird 1 | nginx-mod-devel | 0:1.30.6-1.hum1 |
| Red Hat hummingbird 1 | nginx-mod-http-geoip | 0:1.30.6-1.hum1 |
| Red Hat hummingbird 1 | nginx-mod-http-image-filter | 0:1.30.6-1.hum1 |
| Red Hat hummingbird 1 | nginx-mod-http-perl | 0:1.30.6-1.hum1 |
| Red Hat hummingbird 1 | nginx-mod-http-xslt-filter | 0:1.30.6-1.hum1 |
| Red Hat hummingbird 1 | nginx-mod-mail | 0:1.30.6-1.hum1 |
| Red Hat hummingbird 1 | nginx-mod-stream | 0:1.30.6-1.hum1 |
| Red Hat hummingbird 1 | nginx-mod-stream-geoip | 0:1.30.6-1.hum1 |
| Ubuntu 22.04 LTS | nginx | no fix |
| Ubuntu 24.04 LTS | nginx | no fix |
| Ubuntu 26.04 LTS | nginx | no fix |
| Ubuntu 26.10 | nginx | no fix |
| Ubuntu Pro 14.04 LTS | nginx | no fix |
| Ubuntu Pro 16.04 LTS | nginx | no fix |
| Ubuntu Pro 18.04 LTS | nginx | no fix |
| Ubuntu Pro 20.04 LTS | nginx | no fix |
| openSUSE Tumbleweed | nginx | 1.31.7-1.1 |