All vulnerabilities
CVE-2026-97205

NGINX ngx_http_core_module vulnerability

F5 NGINX PlusWeb servers
Open in ThreatlineRecord JSON
CVSS
8.1High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.48%Chance of exploitation activity in the next 30 days, higher than 40% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in37.1.0.1Also 37.0.5.1, 1.31.7 and 1 moreCVE List
Published14 Oct 2026Updated 15 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Vendor and government advisories 1

Vendors that say their products are affected, and agencies that issued alerts. Check each for the fixed release of the product you run.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

Description

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.

Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Text from CVE List

Affected versions 8

  • NGINX Plusaffected: 37.1.0 before 37.1.0.1CVE List
  • NGINX Plusaffected: 37.0.0 before 37.0.5.1CVE List
  • NGINX Plusaffected: R36 and laterCVE List
  • NGINX Plusaffected: R35 and laterCVE List
  • NGINX Plusaffected: R34 and laterCVE List
  • NGINX Plusaffected: R33 and laterCVE List
  • NGINX Open Sourceaffected: 1.31.0 before 1.31.7CVE List
  • NGINX Open Sourceaffected: 1.30.0 before 1.30.6CVE List

References 1