CVE-2026-97205nginx Use-After-Free
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module.
Published Oct 14, 2026 · Updated Oct 18, 2026 · Also known as EUVD-2026-101115, GHSA-ff5w-vvxc-fm9x
Key Facts
Patch in the next maintenance window- CVE-2026-97205 is a critical-severity vulnerability (CVSS 9.2 v4) affecting Azl3 Httpd 2.4.68-1 (Microsoft), nginx (debian), nginx-main (redhat) and 2 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 0.5% probability of exploitation in the next 30 days.
- Fixed versions are available, including nginx 1.30.4-8, NGINX Open Source 1.30.6, NGINX Open Source 1.31.7.
- Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.
Scores
CVSS v4
9.2
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS (30-day exploit likelihood)
0.5%
Higher than 40.3% of all scored CVEs
Exploit maturity
Proof of concept
ATLAS score
41/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Not listed
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Proof of concept
Public exploit code
1
Proof-of-concept links
In-the-wild evidence
0
Reports of active use
Advisories And Exploit References
- advisoryRHSA-2026:83427
- advisoryRelease Notes
Description
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process.
This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.
Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected Products
10 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Azl3 Httpd 2.4.68-1Microsoft | See advisory | n/a |
| nginxdebian | See advisory | 1.30.4-8 |
| nginx-mainredhat | See advisory | 1.30.6-1.hum1 |
| NGINX Open Source | >= 1.30.0, >= 1.31.0 | 1.30.6 |
| NGINX Plus | >= 37.1.0 | 37.1.0.1 |
Patched Releases
nginx
1.30.4-8
NGINX Open Source
1.30.6, 1.31.7
NGINX Plus
*, 37.0.5.1, 37.1.0.1
nginx-main
1.30.6-1.hum1
Timeline
Publicly disclosed
Oct 14, 2026
Last updated
Oct 18, 2026
Weakness Type
- CWE-416 Use After Free
References
- advisoryRHSA-2026:83427
- advisoryRelease Notes
- othermy.f5.com · K000162608
FAQ
Common Questions.
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module.
Affected: Azl3 Httpd 2.4.68-1 (Microsoft); nginx (debian); nginx-main (redhat), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including nginx 1.30.4-8, NGINX Open Source 1.30.6, NGINX Open Source 1.31.7.
Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.
Is CVE-2026-97205 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo