CVE-2026-97205: CWE-416 Use After Free in F5 NGINX Plus
Description
CVE-2026-97205 is a high-severity Use-After-Free vulnerability in the ngx_http_core_module of NGINX Plus and NGINX Open Source. It occurs when asynchronous file I/O (AIO) is enabled and Server Side Includes (SSI) pages with "include virtual" commands are processed. This flaw can cause memory corruption, worker process crashes, and potentially remote code execution if Address Space Layout Randomization (ASLR) is disabled or bypassed. The issue affects multiple versions of NGINX Plus and Open Source as specified. There is no control plane exposure; the vulnerability impacts only the data plane. No known exploits are reported in the wild, and no patch information is provided in the source data.
CVSS v3.1
Score 8.1high
Affected software
F5
NGINX Plus
F5
NGINX Open Source
pkg:github/nginx/nginxRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2026-97205 is a Use-After-Free (CWE-416) in the ngx_http_core_module of NGINX Plus and NGINX Open Source. It is triggered when asynchronous file I/O (AIO) is enabled and a Server Side Includes (SSI) page containing "include virtual" commands is processed. This leads to a Use-After-Free condition in the NGINX worker process, which can cause memory corruption or a crash. Under certain conditions, such as when ASLR is disabled or bypassed, remote attackers may achieve code execution. The vulnerability affects multiple versions of NGINX Plus and Open Source as listed, with no control plane exposure. The CVSS v3.1 score is 8.1, indicating high severity. No vendor patch or remediation details are provided in the input data.
Potential Impact
Remote attackers may cause denial-of-service (DoS) by crashing NGINX worker processes or corrupting memory. Additionally, they may achieve remote code execution on systems with ASLR disabled or when ASLR can be bypassed. The vulnerability affects only the data plane with no control plane exposure. No known exploits are currently reported in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, consider disabling asynchronous file I/O (AIO) or avoid using Server Side Includes (SSI) with "include virtual" commands in affected versions to reduce exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- f5
- Date Reserved
- 2026-09-30T21:56:14.607Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6acf96722cdf04f6568bcee0
Added to database: 10/14/2026, 14:49:22 UTC
Last enriched: 10/14/2026, 15:03:14 UTC
Last updated: 10/14/2026, 15:08:12 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.