NGINX CVE-2026-56434

Exploitation requires all three directives to be active: Server-Side Includes (ssi) enabled, proxy_pass configured, and proxy_buffering set to off - a non-default combination. The attacker must additionally hold a man-in-the-middle position able to control/modify responses from the upstream server (reflected as AT:P in the CVSS 4.0 vector); a passive network observer or a normal client cannot trigger it. No authentication is required (PR:N) and no user interaction is needed (UI:N), but the MITM prerequisite and the specific configuration are the dominant limiting factors that keep realistic exposure narrow. Deployments that use default proxy_buffering (on), do not use SSI on proxied content, or maintain trusted/integrity-protected upstream links are not exploitable.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H) scores 8.3 (High), but the real-world priority is meaningfully lower than that number suggests because of two constraints. First, AT:P (attack requirements present) reflects the mandatory MITM position controlling upstream responses - a non-trivial precondition that is not present in most deployments. Second, exploitation only works under a specific non-default configuration (SSI + proxy_pass + proxy_buffering off). Impact is bounded: VC:N (no confidentiality loss), VI:L (limited integrity/memory modification), VA:H (worker crash/DoS) - not remote code execution. This is not in CISA KEV and no POC is referenced, so there is no evidence of active exploitation. Net assessment: a legitimately high-severity memory-safety bug for the narrow set of environments running the required SSI+proxy configuration and exposed to upstream tampering, but a low priority for the large majority of NGINX deployments that do not use that combination. No EPSS score was provided, so exploitation-probability data is missing.

An attacker positioned between NGINX and its upstream (e.g., via ARP spoofing, a compromised network segment, or an untrusted upstream link) waits for NGINX - configured with SSI, proxy_pass, and proxy_buffering off - to proxy a request. The attacker tampers with the upstream response to include crafted content that triggers the SSI parser's out-of-bounds read, causing limited memory modification or a worker-process restart (denial of service). No public exploit code is currently identified, and exploitation requires the MITM position (AT:P) plus the specific NGINX configuration.