Skip to content
VulniPulse
Sign in
Highest advisory severityCritical 2 vendors · 2 advisories

CVE-2026-97205

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module

CVE-2026-97205: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. Not in the CISA KEV catalog.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

CVE-2026-97205 at a glance

CISA KEV
Not listed (catalog checked )
Highest advisory severity
Critical
CVSS base score
9.2 (F5), 8.1 (Red Hat)
Weakness
CWE-416
Fixed releases
  • F5: 37.1.0.1, 37.0.5.1, 1.31.7, 1.30.6
  • Red Hat: nginx-main-1.30.6-1.hum1, RHSA-2026:83427
Vendor advisories
2 from F5, Red Hat
VulniPulse record
Published · Updated

Scores, vectors, weaknesses and fixed releases are quoted from vendor advisories that cover only CVE-2026-97205; bulletin-wide values are not repeated here.

Is CVE-2026-97205 exploited?

No exploitation is reported in the sources VulniPulse tracks: CVE-2026-97205 is not in the CISA KEV catalog (checked ) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.

How do I fix CVE-2026-97205?

Upgrade to a fixed release named by the vendor:

  • F5: 37.1.0.1, 37.0.5.1, 1.31.7, 1.30.6
  • Red Hat: nginx-main-1.30.6-1.hum1, RHSA-2026:83427
  • To mitigate this vulnerability, based on your environment requirements, you can either disable asynchronous file I/O (AIO) or Server Side Includes (SSI). (Red Hat)

Vendor advisory comparison

F5

1 advisory
  • Advisory severityCritical9.2

    Critical [CVE-2026-97205] NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module

    CVE-2026-97205Source published Source updated

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of…

    Affected products in this advisory
    • NGINX Plus
    • NGINX Open Source
    Source-reported affected versions
    • NGINX Plus 37.1.0 before 37.1.0.1
    • NGINX Plus 37.0.0 before 37.0.5.1
    • NGINX Plus R36
    • NGINX Plus R35

    4 more entries in the full advisory.

    Source-reported fixed versions
    • 37.1.0.1
    • 37.0.5.1
    • 1.31.7
    • 1.30.6
    Mitigation guidance
    No mitigation guidance extracted; consult the source.
    Full advisory and evidenceOpen source bulletin

Red Hat

1 advisory
  • Advisory severityHigh8.1

    High [CVE-2026-97205] NGINX ngx_http_core_module vulnerability

    CVE-2026-97205Source published Source updated

    NGINX ngx_http_core_module vulnerability. Red Hat rates this important (CVSS 8.1). Weakness: CWE-416. Red Hat lists fixing advisory RHSA-2026:83427 with package nginx-main-1.30.6-1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 1 more.

    Related products — impact not confirmed
    • Red Hat Hardened Images
    • Red Hat Enterprise Linux 10
    • Red Hat Enterprise Linux 8
    • Red Hat Enterprise Linux 9

    1 more entries in the full advisory.

    Source-reported affected versions
    Affected-version details not available in this record.
    Source-reported fixed versions
    • nginx-main-1.30.6-1.hum1
    • RHSA-2026:83427
    Mitigation guidance
    • To mitigate this vulnerability, based on your environment requirements, you can either disable asynchronous file I/O (AIO) or Server Side Includes (SSI).
    Full advisory and evidenceOpen source bulletin

Browse the latest tracked CVEs or the CVEs listed in CISA KEV.

Android app · Google Play

Turn CVE research into alerts on your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features