External risk intelligence

NGINX Use-After-Free in HTTP Core Module Affects Server Side Includes

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-97205

NGINX is a primary internet-facing web server, reverse proxy, and load balancer designed to handle public HTTP/HTTPS traffic. Because the vulnerability exists in core request processing modules frequently used to serve public web content, the vulnerable surface is exposed to the internet by design in standard, common deployment patterns.

Use After Free

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in NGINX Plus and NGINX Open Source affecting core request processing. This issue, when triggered by specific configurations, could lead to memory corruption, system crashes, or potentially unauthorized code execution. The primary concern for leadership is to confirm the relevance and exposure of this vulnerability within your specific NGINX deployments.

Affects NGINX web server core processing.
Confirms relevance and exposure to leadership.
Assess potential impact on critical services.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted requests to a web server running NGINX with Server Side Includes (SSI) and asynchronous file I/O enabled. If the server processes an SSI page containing specific "include virtual" commands, it could lead to memory corruption or a crash in an NGINX worker process, potentially allowing for code execution under certain conditions.

No special access required.
Malicious SSI pages with specific includes.
Memory corruption or code execution.

Live Threat

Current exploitation, exposure, and threat context

When asynchronous file I/O is enabled in specific configurations, processing a Server Side Includes (SSI) page with "include virtual" commands could lead to memory corruption or a worker process crash in NGINX. Attackers may also be able to execute code if Address Space Layout Randomization (ASLR) is disabled or bypassed.

Worker process memory integrity.
Memory corruption or worker crash.
Denial-of-service or code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in NGINX affects the data plane and could lead to denial-of-service, memory corruption, or code execution. Identifying affected NGINX instances, determining their reachability and criticality, and confirming ownership are the first practical steps. Remediation planning should then proceed based on the assessed risk.

Ownership: NGINX or application platform team.
Verify: Reachability and business criticality.
Action: Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is NGINX and what is it used for?

NGINX is a high-performance web server, reverse proxy, and load balancer. It sits at the edge of network infrastructure to manage incoming HTTP/HTTPS traffic, distributing requests to backend applications and serving static content. Because it is highly efficient at handling large volumes of concurrent connections, it is a foundational component for many public-facing web services and internal application delivery platforms.

What does this Use-After-Free vulnerability mean for NGINX?

This CVE involves a Use-After-Free (CWE-416) weakness. In plain terms, the software tries to use a piece of computer memory that it has already freed or released. When this happens during the processing of specific webpage commands, it can cause the memory to become corrupted or force the NGINX worker process to crash, which results in a denial-of-service.

How is this NGINX vulnerability triggered?

An attacker triggers this by sending specially crafted web requests. Crucially, the bug only manifests when the server has two specific features enabled simultaneously: asynchronous file I/O and Server Side Includes (SSI). If these features are not both configured and in use, the specific code path leading to this memory management error is not invoked.

Is my NGINX deployment relevant to this threat?

Halo Surface Signal indicates that because NGINX is commonly used as an internet-facing entry point to handle public traffic, this vulnerability is highly likely to be exposed. If your server is reachable from the internet and utilizes the specific SSI and asynchronous file I/O configurations, it occupies the vulnerable surface area described in this advisory.

What are the first steps to take if I run NGINX?

Start by identifying all NGINX instances in your environment and auditing their configuration files. Determine if the combination of Server Side Includes and asynchronous file I/O is active on any of your servers. Once you have a list of potentially affected systems, prioritize them based on their business criticality and internet reachability to plan your next steps.

References

my.f5.com/manage/s/article/K000162608

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.