Search: CVE-2026-97205

CVE-2026-97205 is a Use-After-Free vulnerability in the ngx_http_core_module of NGINX Plus and NGINX Open Source. It occurs when asynchronous file I/O (AIO) is enabled and a Server Side Includes (SSI) page with "include virtual" commands is processed. This can cause memory corruption, worker process crashes, or potentially remote code execution on systems without ASLR or where ASLR is bypassed. The vulnerability affects specific versions of NGINX Plus and Open Source as listed. It is a high severity issue with a CVSS score of 8.1. There is no control plane exposure; the issue is limited to the data plane. No patch links are provided in the data, and the vendor advisory status is not explicitly stated.