CVE-2026-97205
CRITICAL 9.2NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Severe if exploited (CVSS 9.2), but no known exploitation and low modeled probability. Patch on a normal cadence.
Exploitation likelihood
0.8%chance of exploitation in 30 days · 57th percentile
Impact if exploited
9.2CVSS 4.0 · CRITICAL
- ConfidentialityHigh
- IntegrityHigh
- AvailabilityHigh
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ✓Privileges: No account or privileges required
- ✓User interaction: No user interaction needed
- ⚠Complexity: Needs a race window or specific setup
- ✓Requirements: No special attack requirements
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Weakness (CWE)
- CWE-416: Use After Free
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References and research data (JSON)
Vendor product assessments
Showing 32 of 91 vendor product statements; 59 omitted. Read the full vendor advisory.
nginx-0:1.30.6-1.hum1@aarch64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: To mitigate this vulnerability, based on your environment requirements, you can either disable asynchronous file I/O (AIO) or Server Side Includes (SSI).
nginx-0:1.30.6-1.hum1@src as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=src&distro=hummingbird-20251124&repository_id=public-hummingbird-source-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: To mitigate this vulnerability, based on your environment requirements, you can either disable asynchronous file I/O (AIO) or Server Side Includes (SSI).
nginx-all-modules-0:1.30.6-1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: To mitigate this vulnerability, based on your environment requirements, you can either disable asynchronous file I/O (AIO) or Server Side Includes (SSI).
nginx-core-0:1.30.6-1.hum1@aarch64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: To mitigate this vulnerability, based on your environment requirements, you can either disable asynchronous file I/O (AIO) or Server Side Includes (SSI).
nginx-filesystem-0:1.30.6-1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: To mitigate this vulnerability, based on your environment requirements, you can either disable asynchronous file I/O (AIO) or Server Side Includes (SSI).
nginx-filesystem-0:1.30.6-1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: To mitigate this vulnerability, based on your environment requirements, you can either disable asynchronous file I/O (AIO) or Server Side Includes (SSI).
nginx-mod-devel-0:1.30.6-1.hum1@s390x as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: To mitigate this vulnerability, based on your environment requirements, you can either disable asynchronous file I/O (AIO) or Server Side Includes (SSI).
nginx-mod-http-geoip-0:1.30.6-1.hum1@s390x as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: To mitigate this vulnerability, based on your environment requirements, you can either disable asynchronous file I/O (AIO) or Server Side Includes (SSI).
nginx-mod-http-image-filter-0:1.30.6-1.hum1@aarch64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: To mitigate this vulnerability, based on your environment requirements, you can either disable asynchronous file I/O (AIO) or Server Side Includes (SSI).
nginx-mod-http-perl-0:1.30.6-1.hum1@aarch64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: To mitigate this vulnerability, based on your environment requirements, you can either disable asynchronous file I/O (AIO) or Server Side Includes (SSI).
nginx-mod-http-perl-0:1.30.6-1.hum1@x86_64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: To mitigate this vulnerability, based on your environment requirements, you can either disable asynchronous file I/O (AIO) or Server Side Includes (SSI).
nginx-mod-http-xslt-filter-0:1.30.6-1.hum1@s390x as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: To mitigate this vulnerability, based on your environment requirements, you can either disable asynchronous file I/O (AIO) or Server Side Includes (SSI).
nginx-mod-mail-0:1.30.6-1.hum1@s390x as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: To mitigate this vulnerability, based on your environment requirements, you can either disable asynchronous file I/O (AIO) or Server Side Includes (SSI).
nginx-mod-stream-0:1.30.6-1.hum1@aarch64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: To mitigate this vulnerability, based on your environment requirements, you can either disable asynchronous file I/O (AIO) or Server Side Includes (SSI).
nginx-mod-stream-geoip-0:1.30.6-1.hum1@aarch64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: To mitigate this vulnerability, based on your environment requirements, you can either disable asynchronous file I/O (AIO) or Server Side Includes (SSI).
nginx-mod-stream-geoip-0:1.30.6-1.hum1@x86_64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: To mitigate this vulnerability, based on your environment requirements, you can either disable asynchronous file I/O (AIO) or Server Side Includes (SSI).
nginx as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nginx
- workaround: To mitigate this vulnerability, based on your environment requirements, you can either disable asynchronous file I/O (AIO) or Server Side Includes (SSI).
- none available: Affected
nginx-mod-devel as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nginx-mod-devel
- workaround: To mitigate this vulnerability, based on your environment requirements, you can either disable asynchronous file I/O (AIO) or Server Side Includes (SSI).
- none available: Affected
nginx-mod-http-xslt-filter as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nginx-mod-http-xslt-filter
- workaround: To mitigate this vulnerability, based on your environment requirements, you can either disable asynchronous file I/O (AIO) or Server Side Includes (SSI).
- none available: Affected
nginx-all-modules (nginx:1.24) as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nginx-all-modules?rpmmod=nginx:1.24
- workaround: To mitigate this vulnerability, based on your environment requirements, you can either disable asynchronous file I/O (AIO) or Server Side Includes (SSI).
- none available: Affected
nginx-mod-http-image-filter (nginx:1.24) as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nginx-mod-http-image-filter?rpmmod=nginx:1.24
- workaround: To mitigate this vulnerability, based on your environment requirements, you can either disable asynchronous file I/O (AIO) or Server Side Includes (SSI).
- none available: Affected
nginx-mod-stream (nginx:1.24) as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nginx-mod-stream?rpmmod=nginx:1.24
- workaround: To mitigate this vulnerability, based on your environment requirements, you can either disable asynchronous file I/O (AIO) or Server Side Includes (SSI).
- none available: Affected
nginx as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nginx
- workaround: To mitigate this vulnerability, based on your environment requirements, you can either disable asynchronous file I/O (AIO) or Server Side Includes (SSI).
- none available: Affected
nginx-core as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nginx-core
- workaround: To mitigate this vulnerability, based on your environment requirements, you can either disable asynchronous file I/O (AIO) or Server Side Includes (SSI).
- none available: Affected
nginx-filesystem as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nginx-filesystem
- workaround: To mitigate this vulnerability, based on your environment requirements, you can either disable asynchronous file I/O (AIO) or Server Side Includes (SSI).
- none available: Affected
nginx-mod-devel (nginx:1.24) as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nginx-mod-devel?rpmmod=nginx:1.24
- workaround: To mitigate this vulnerability, based on your environment requirements, you can either disable asynchronous file I/O (AIO) or Server Side Includes (SSI).
- none available: Affected
nginx-mod-http-image-filter (nginx:1.24) as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nginx-mod-http-image-filter?rpmmod=nginx:1.24
- workaround: To mitigate this vulnerability, based on your environment requirements, you can either disable asynchronous file I/O (AIO) or Server Side Includes (SSI).
- none available: Affected
nginx-mod-http-perl (nginx:1.26) as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nginx-mod-http-perl?rpmmod=nginx:1.26
- workaround: To mitigate this vulnerability, based on your environment requirements, you can either disable asynchronous file I/O (AIO) or Server Side Includes (SSI).
- none available: Affected
nginx-mod-http-xslt-filter (nginx:1.26) as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nginx-mod-http-xslt-filter?rpmmod=nginx:1.26
- workaround: To mitigate this vulnerability, based on your environment requirements, you can either disable asynchronous file I/O (AIO) or Server Side Includes (SSI).
- none available: Affected
nginx-mod-stream as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nginx-mod-stream
- workaround: To mitigate this vulnerability, based on your environment requirements, you can either disable asynchronous file I/O (AIO) or Server Side Includes (SSI).
- none available: Affected
nginx.src as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nginx?arch=src
- workaround: To mitigate this vulnerability, based on your environment requirements, you can either disable asynchronous file I/O (AIO) or Server Side Includes (SSI).
- none available: Affected
nginx (nginx:1.26) as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nginx?rpmmod=nginx:1.26
- workaround: To mitigate this vulnerability, based on your environment requirements, you can either disable asynchronous file I/O (AIO) or Server Side Includes (SSI).
- none available: Affected
Unverified PoC candidates
Catalogue matches for further research. These repositories have not been validated as working exploits.
1 candidate
- https://github.com/suominen/CVE-2026-97205PoC-in-GitHub · CVE-2026-97205
PoC-in-GitHub · CVE-2026-97205 · Updated 2026-10-26T06:30:55Z
All CVSS metrics
- HIGH 8.1 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CRITICAL 9.2 v4.0 · CNA Primary
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CRITICAL 9.2 v4.0 · NVD Secondary
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - HIGH 8.1 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
Advisories
- https://my.f5.com/manage/s/article/K000162608 CVE record · f5 · Updated 2026-10-14T14:40:27.487Z
NVD · CVE-2026-97205 · Updated 2026-10-15T11:18:08.670
Red Hat · CVE-2026-97205 · Updated 2026-10-16T14:52:19+00:00 - https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-97205.json Red Hat · CVE-2026-97205 · Updated 2026-10-16T14:52:19+00:00
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101115 EUVD · EUVD-2026-101115
Technical & other
- https://access.redhat.com/security/cve/CVE-2026-97205 Red Hat · CVE-2026-97205 · Updated 2026-10-16T14:52:19+00:00
- https://bugzilla.redhat.com/show_bug.cgi?id=2552359 Red Hat · CVE-2026-97205 · Updated 2026-10-16T14:52:19+00:00
- https://www.cve.org/CVERecord?id=CVE-2026-97205 Red Hat · CVE-2026-97205 · Updated 2026-10-16T14:52:19+00:00
- https://nvd.nist.gov/vuln/detail/CVE-2026-97205 Red Hat · CVE-2026-97205 · Updated 2026-10-16T14:52:19+00:00
- https://access.redhat.com/errata/RHSA-2026:83427 Red Hat · CVE-2026-97205 · Updated 2026-10-16T14:52:19+00:00