NGINX Open Source and NGINX Plus (asynchronous file I/O)
CVE-2026-97205: NGINX use-after-free when AIO serves SSI pages
A use-after-free in NGINX workers when asynchronous file I/O (AIO) is on and a page uses SSI "include virtual". It can crash workers, and may give code execution where ASLR is off or bypassed. No exploitation has been reported.
Published Updated
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| NGINX Open Source 1.31.x (nginx.org lists 0.8.11 and later) | 1.31.7 or later |
| NGINX Open Source 1.30.x | 1.30.6 or later |
| NGINX Plus 37.1.0 | 37.1.0.1 or later |
| NGINX Plus 37.0.0 | 37.0.5.1 or later |
| NGINX Plus R33 to R36 | No fixed version listed in the CVE record |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
A use-after-free (CWE-416) in the NGINX worker process, in ngx_http_core_module. It happens when asynchronous file I/O (the aio directive) is enabled in certain configurations and NGINX processes a Server Side Includes (SSI) page that uses include virtual commands. The nginx.org entry is titled “Use-after-free when using asynchronous file I/O (AIO)”.
- Crash or memory corruption: the worker process can crash and restart, or its memory can be corrupted.
- Code execution: possible on systems with ASLR disabled, or where an attacker can bypass it, according to the CVE record.
Only the data plane is affected. There is no control plane exposure. The CVE record scores it 8.1 in CVSS 3.1 and 9.2 in CVSS 4.0. nginx.org rates it “medium”. Cyberlanc3r reported it. The sources we opened state nothing about exploitation, a public proof of concept or a CISA KEV listing.
This is a different bug from CVE-2026-56434, which is in ngx_http_ssi_module.
Am I affected?
Yes, if both are true:
- You run an affected version: nginx.org lists NGINX Open Source 0.8.11 through 1.31.6 as vulnerable. The CVE record lists NGINX Plus 37.0.0 to before 37.0.5.1, 37.1.0 to before 37.1.0.1, and R33 to R36.
- Your configuration enables
aioand serves SSI pages (ssi on;) that useinclude virtual. The CVE record says “certain configurations” without detail.
Search every included file, not just nginx.conf. nginx -T prints the full configuration, including includes.
Not affected: NGINX Open Source 1.31.7 and later, and 1.30.6 and later. F5 did not evaluate releases past End of Technical Support.
What to do
- Upgrade. NGINX Open Source to 1.31.7 (mainline) or 1.30.6 (stable) or later. NGINX Plus to 37.0.5.1 or 37.1.0.1 or later. For Plus R33 to R36 the CVE record lists no fix, so read the F5 advisory and move to a fixed release. Remember the NGINX inside appliances, containers and ingress controllers, and distribution packages, which carry their own fixes.
- If you can’t upgrade yet, use the workaround in the CVE record: disable the
aiodirective, or do not serve SSI pages. Turning offaiocan change file-serving performance, so test it first. - Make sure ASLR is enabled on hosts running NGINX. It does not stop the crash, but it stands between this bug and code execution.
- If a vulnerable server was internet-facing, check it (below). If you find signs of code execution, rebuild the host and rotate the TLS keys and any credentials it held.
Detection
No indicators of compromise have been published.
- Worker crashes in the NGINX error log. Look for workers exiting on a signal, such as segmentation faults, and a rise in worker restarts.
- Requests that line up with the crashes, especially to pages that use SSI includes.
- After a crash, unexpected child processes of NGINX workers or outbound connections from the server, which would point to code execution.
Indicators of compromise
No indicators of compromise have been published for this CVE yet. We'll add them here if the vendor or a researcher releases any. Until then, use the behaviour in Detection.
Sources
Page changelog
- Full analysis published.
KEV status, EPSS score and vendor data refreshed automatically, last on 15 Oct 2026.