EUVD-2026-101115
GHSA-ff5w-vvxc-fm9x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach SSI page over network
-
DeliveryRequest page with 'include virtual'
-
ExploitTrigger use-after-free in worker
-
ExecutionCorrupt freed memory
-
PersistCrash worker or hijack control flow
-
ImpactDoS or code execution (ASLR-dependent)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the server to have asynchronous file I/O (AIO) enabled AND Server Side Includes (SSI) processing active, with a served page containing 'include virtual' commands - neither AIO nor SSI is enabled by default, so this is a non-default configuration dependency that sharply limits the vulnerable population. Reaching the DoS/memory-corruption outcome needs no authentication or user interaction (PR:N/UI:N) once that configuration is present. Code execution is further gated: it is only feasible on systems where Address Space Layout Randomization (ASLR) is disabled or where the attacker can otherwise bypass ASLR; on default hardened systems the realistic outcome is a worker crash or memory corruption. This is a data-plane-only issue with no control-plane exposure. |
| Impact | This F5-reported Use-After-Free (CWE-416) in NGINX's ngx_http_core_module carries a high CVSS 4.0 base score of 9.2 (AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H), reflecting network reachability and unauthenticated access but tempered by high attack complexity. The signals are notably mixed. On one side, NGINX is ubiquitous and the flaw is remote and unauthenticated (PR:N), which argues for priority. On the other side, AC:H is well-justified because exploitation depends on a specific non-default pairing - asynchronous file I/O (AIO) enabled together with SSI processing of 'include virtual' - so most deployments are not vulnerable in their default state. The most reliable impact is denial-of-service (worker crash) and memory corruption; code execution is explicitly conditional on ASLR being disabled or bypassed, making RCE the least likely outcome against hardened modern systems. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The 9.2 score should be read as a worst-case data-plane ceiling rather than a reflection of broad real-world exploitability; realistic risk is DoS against the specific subset of hosts running the vulnerable AIO+SSI configuration. |
| Exploit ScenarioDerived | An attacker identifies an NGINX server configured with AIO enabled and SSI processing active, then requests an SSI-enabled page containing 'include virtual' directives, triggering the use-after-free in the worker process. This typically crashes or corrupts the worker memory (DoS); on a host where ASLR is disabled or can be bypassed, the attacker may leverage the UAF toward code execution. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 14, 2026
Unauthenticated remote attackers can trigger a use-after-free in NGINX's ngx_http_core_module when asynchronous file I/O (AIO) is enabled and a Server Side Includes (SSI) page containing 'include virtual' commands is processed, causing memory corruption or a worker process crash. This affects both NGINX Plus and NGINX Open Source, with code execution possible only on systems where Address Space Layout Randomization (ASLR) is disabled or can be bypassed. Exploitation requires a non-default configuration (AIO and SSI enabled), and no public exploit code was identified at time of analysis.
Earlier versions of this analysis (1)
A use-after-free in NGINX's ngx_http_core_module allows a remote, unauthenticated attacker to crash worker processes or corrupt memory, and potentially execute code, but only when asynchronous file I/O (AIO) is enabled in a non-default configuration and the server processes a Server Side Includes page containing 'include virtual' commands. Neither AIO nor SSI is active in a stock NGINX installation, and code execution is further gated on ASLR being disabled or bypassable, so on typical ASLR-enabled systems the realistic outcome is a worker process crash or memory corruption (denial of service). No public exploit code has been identified at time of analysis, the issue affects NGINX Plus and NGINX Open Source, and there is no control-plane exposure - this is strictly a data-plane problem.
RemediationAI
No vendor-released patch was identified in the provided data; consult the F5 advisory K000162608 (https://my.f5.com/manage/s/article/K000162608) for the latest patched versions. As a compensating control, disable asynchronous file I/O (AIO) and/or Server Side Includes (SSI) if they are not required, since both are non-default features. Disabling AIO may reduce performance for large file operations, while disabling SSI may break dynamic content generation. Ensure Address Space Layout Randomization (ASLR) is enabled to prevent code execution. If SSI must remain enabled, restrict access to SSI pages and monitor for worker process crashes. Apply the principle of least privilege to limit impact. Note that this is a data-plane-only issue with no control-plane exposure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a Use-After-Free (CWE-416) in the ngx_http_core_module of NGINX. This core module handles HTTP request processing, including asynchronous file I/O (AIO) and Server Side Includes (SSI). When AIO is enabled in certain configurations and an SSI page includes 'include virtual' directives, the worker process may access memory after it has been freed, leading to memory corruption or a crash. The CPE data identifies affected products as F5 NGINX Plus (cpe:2.3:a:f5:nginx_plus) and F5 NGINX Open Source (cpe:2.3:a:f5:nginx_open_source). This is a data-plane-only issue with no control-plane exposure. The CVSS vector shows network reachability with unauthenticated access (PR:N) but high attack complexity (AC:H) due to the dependency on non-default AIO and SSI configurations.
Know when Nginx Plus gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network-reachable and unauthenticated (AV:N/PR:N), but AC:H because exploitation needs the non-default AIO+SSI configuration; high C/I/A reflect the potential code-execution ceiling with scope unchanged.
Primary rating from Vendor (f5).
CVSS VectorVendor: f5
Lifecycle Timeline
4DescriptionCVE.org
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.
Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Articles & Coverage 1
Executive ViewAI
Organizations running NGINX Plus or NGINX Open Source with a specific non-default combination of features (asynchronous file I/O and server-side includes) are exposed to a critical memory-corruption flaw that can crash worker processes and, under limited conditions, enable remote code execution on the host. Because no vendor patch exists, the organization's exposure window is entirely dependent on how quickly platform and network teams can identify and reconfigure affected internet-facing services. Leadership should treat this as a configuration-hygiene and availability risk that is manageable through immediate engineering action rather than a product replacement decision.
No vendor-released patch identified at time of analysis. Interim mitigations: disable asynchronous file I/O ('aio off') or server-side includes ('ssi off') on all NGINX Plus and NGINX Open Source instances, particularly internet-facing ones; remove or refactor 'include virtual' directives; restrict network access to services that require SSI; ensure ASLR remains enabled at the OS and container level; apply WAF or reverse-proxy rules that block or alert on SSI virtual include request patterns; limit concurrent connections and apply rate limiting to reduce crash/DoS impact; and monitor nginx error logs and process supervisors for worker process crashes and abnormal restarts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Nginx Plus
View allDenial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Heap buffer overflow in NGINX Plus and NGINX Open Source ngx_http_rewrite_module allows remote attackers to crash worker
Heap-based buffer overflow in NGINX Plus and NGINX Open Source affects deployments that proxy HTTP/2 or gRPC traffic ups
Heap buffer overflow in NGINX Plus and NGINX Open Source ngx_http_rewrite_module can be triggered by unauthenticated rem
Heap buffer overflow in NGINX Plus and NGINX Open Source lets unauthenticated remote attackers crash worker processes (D
Heap buffer overflow in NGINX Plus and NGINX Open Source can be triggered by crafted HTTP requests when a non-default ma
Heap buffer overflow in NGINX Plus and NGINX Open Source can be triggered by unauthenticated remote attackers through cr
Limited memory disclosure and worker-process restart in NGINX Plus and NGINX Open Source arise when the optional ngx_htt
Buffer overflow in NGINX's DAV module allows remote attackers to crash worker processes or manipulate file names outside
NGINX worker process crashes via null pointer dereference in the mail authentication module when CRAM-MD5 or APOP authen
When the NGINX Plus is configured to use the MQTT pre-read module, undisclosed requests can cause an increase in memory
NGINX Open Source and NGINX Plus contain a buffer over-read or over-write vulnerability in the ngx_http_mp4_module that
Exploit-DB