F5 NGINX: Use-after-free in ngx_http_core_module (SSI with AIO)

Summary

NGINX Open Source and NGINX Plus contain a use-after-free flaw (CWE-416) in the ngx_http_core_module. It occurs only when asynchronous file I/O (aio) is enabled and a Server Side Includes (SSI) page uses "include virtual". A remote attacker can trigger memory corruption or a worker process crash, and code execution is possible where ASLR is disabled or can be bypassed. F5 states that there is no control plane exposure.

Affected

• NGINX Open Source 1.30.0 to before 1.30.6
• NGINX Open Source 1.31.0 to before 1.31.7
• NGINX Plus 37.0.0 to before 37.0.5.1
• NGINX Plus 37.1.0 to before 37.1.0.1
• NGINX Plus R33 to R36: affected, fixed release not listed in the CVE record (default: unknown)
• End-of-Technical-Support versions are not evaluated; branches such as 1.28 may have no fix.

Fixed in

• NGINX Open Source 1.30.6 and 1.31.7 (per the CVE record ranges)
• NGINX Plus 37.0.5.1 and 37.1.0.1 (per the CVE record ranges; conflicting secondary sources, confirm with F5 K000162608)
• Distribution packages: depends on the vendor backport; check your distribution security notice.

Workaround

• Disable the "aio" directive, or do not serve SSI pages (F5 recommendation).
• Restart NGINX after the change.
• Verify that ASLR is enabled on NGINX hosts. This reduces the code-execution risk but does not fix the crash risk.

Exploitation

• No evidence of exploitation in the wild found; not listed in CISA KEV at time of research.
• CISA SSVC: exploitation none, not automatable, total technical impact.
• A public proof-of-concept is claimed by one tracker but is unverified; do not run untrusted code.

Our recommendation

• Inventory all NGINX instances, versions and package builds, including NGINX Plus.
• Check whether "aio" and SSI are enabled (for example with nginx -T | grep -Ei 'aio|ssi'); if both are enabled, disable one immediately.
• Patch to the fixed build for your branch or distribution, and confirm NGINX Plus builds with F5 K000162608.
• Re-test the configuration after changes and monitor worker crashes in the error log.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  suominen/CVE-2026-97205

Research sources

• F5 security advisory K000162608 my.f5.com
• Red Hat CVE-2026-97205 access.redhat.com
• OpenCVE CVE-2026-97205 app.opencve.io
• Ionix threat center CVE-2026-97205 www.ionix.io
• Offseq threat radar CVE-2026-97205 radar.offseq.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:33.