CVE-2026-97205

Name of the Vulnerable Software and Affected Versions NGINX Plus (affected versions not specified) NGINX Open Source (affected versions not specified)

Description A Use-After-Free (UAF) issue exists in the ngx http core module module. When asynchronous file I/O (AIO) is enabled in specific configurations, processing a Server Side Includes (SSI) page that uses "include virtual" commands can trigger this condition in the NGINX worker process. This may lead to memory corruption, a worker process crash, or a denial-of-service (DoS). Furthermore, remote attackers could potentially execute code on systems where Address Space Layout Randomization (ASLR)—a security technique that randomly arranges the address space positions of key data areas—is disabled or bypassed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.