CVE-2026-97205
NGINX SSI with AIO use-after-free in worker process
F5 fixed a use-after-free when AIO is enabled and an SSI page uses include virtual in NGINX Plus and NGINX Open Source. F5 scores it CVSS 4.0 9.2 (Critical) and CVSS 3.1 8.1 (High). nginx.org rates it medium. An unauthenticated attacker can crash a worker, or run code if ASLR is off or bypassed. Specific configuration required. Fixed in OSS 1.31.7 and 1.30.6 and Plus 37.1.0.1 and 37.0.5.1. Not in CISA KEV.
- CVSS
- 9.2
- Vector
- CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Class
- RCE
- Status
- No PoC
- KEV
- Not in CISA KEV
- 0-day
- No
- Vendor
- F5
- Products
- NGINX Plus, NGINX Open Source
- Affected
- NGINX Plus 37.1.0 before 37.1.0.1, 37.0.0 before 37.0.5.1, and R33 to R36. NGINX Open Source 1.31.0 before 1.31.7 and 1.30.0 before 1.30.6 per F5. nginx.org lists 0.8.11 to 1.31.6 as vulnerable. Only specific configurations are exposed.
- Fixed
- NGINX Open Source 1.31.7 (mainline) and 1.30.6 (stable), and NGINX Plus 37.1.0.1 and 37.0.5.1, released 14 October 2026. F5 lists no fix for Plus R33 to R36.
- CWE
- CWE-416
- Published
- 14 Oct 2026
- Updated
- 14 Oct 2026
No public PoC is confirmed on this record.
CVE-2026-97205 is a use-after-free when AIO is enabled and an SSI page uses include virtual in NGINX Plus and NGINX Open Source. F5 published its advisory on 14 October 2026. The weakness is CWE-416.
It needs asynchronous file I/O (AIO) enabled in certain configurations. A Server Side Includes (SSI) page must contain include virtual commands. Default configurations are not described as affected.
F5 scores it CVSS 4.0 9.2 (Critical) and CVSS 3.1 8.1 (High). nginx.org rates the same issue medium. NVD shows the F5 scores and is awaiting analysis.
An unauthenticated attacker can send crafted HTTP requests and crash the worker process. F5 says code execution is possible when ASLR is disabled or can be bypassed. F5 says this is a data plane issue with no control plane exposure.
Fixed versions are NGINX Open Source 1.31.7 and 1.30.6, and NGINX Plus 37.1.0.1 and 37.0.5.1. F5 lists Plus R33 to R36 as affected with no fix. F5 credits Cyberlanc3r. The nginx changelog thanks cyberlancer.
The CVE is not in the CISA KEV catalog. ThreatWire found no report of exploitation and no public PoC.