CVE-2026-56434 is a use-after-free vulnerability (CWE-416) in the ngx_http_ssi_module of NGINX Plus and NGINX Open Source. It occurs under a specific configuration involving SSI, proxy_pass, and proxy_buffering off. An unauthenticated attacker with MITM ability to manipulate upstream server responses can cause a heap buffer over-read in the NGINX worker process. This vulnerability may result in limited memory modification or a restart of the worker process. The vulnerability affects NGINX Plus versions =37.0.0.1, =R36, and =R33. There is no control plane exposure, only data plane impact. No patch or official remediation level has been provided as of the published date.

Remote attackers with man-in-the-middle capability may cause limited modification of memory contents or force a restart of the NGINX worker process. There is no impact on the control plane, limiting the scope to data plane disruptions. This could affect service availability or stability but does not allow full system compromise or control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented. Users should monitor vendor communications for updates. Until a fix is available, consider mitigating the risk by reviewing and possibly adjusting configurations involving SSI, proxy_pass, and proxy_buffering directives to reduce exposure to manipulated upstream responses.