Ngx_http_core_module: memory corruption

NGINX Plus

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process.

Do this now

Upgrade NGINX Plus to 37.1.0.1 or 37.0.5.1 and NGINX Open Source to 1.31.7 or 1.30.6, matching your release line; 36.x, 35.x, 34.x and 33.x: move to 37.0.5.1 or later.

Fix it

NGINX Plus

On 37.0.xUpgrade to NGINX Plus 37.0.5.1
On 37.1.xUpgrade to NGINX Plus 37.1.0.1
On 36.xNo fix on 36.x yet; move to 37.0.5.1+ (newer branch)
On 35.xNo fix on 35.x yet; move to 37.0.5.1+ (newer branch)
On 34.xNo fix on 34.x yet; move to 37.0.5.1+ (newer branch)
On 33.xNo fix on 33.x yet; move to 37.0.5.1+ (newer branch)

NGINX Open Source

On 1.30.xUpgrade to NGINX Open Source 1.30.6
On 1.31.xUpgrade to NGINX Open Source 1.31.7

First seen: 27 Oct 2026
Last update: 27 Oct 2026, 08:17 UTC
Fixed in: NGINX Plus 37.1.0.1
NGINX Plus 37.0.5.1
NGINX Open Source 1.31.7
NGINX Open Source 1.30.6
Identifiers: CVE-2026-97205
CVSS: 8.1
Source: news
On the menu as: nginx

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Ngx_http_core_module: memory corruption
Severity: high. Patch status: partial fix.
Affected: NGINX Plus
Fixed in: NGINX Plus 37.1.0.1, NGINX Plus 37.0.5.1, NGINX Open Source 1.31.7, NGINX Open Source 1.30.6
Ids: CVE-2026-97205

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process.

## Steps
1. This touches infrastructure (nginx). Look in terraform, ansible, cloud-init, Dockerfiles and docs for the product and version we run. If it isn't in the repo, say so and list what a human should check on the box.
2. Fix by release line: NGINX Plus: 37.1.x → 37.1.0.1; 37.0.x → 37.0.5.1. NGINX Open Source: 1.31.x → 1.31.7; 1.30.x → 1.30.6. No fix yet on NGINX Plus R36.x, R35.x, R34.x, R33.x. Until one ships: restrict network access to it.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| NGINX Plus 37.1.x | fixed | 37.1.0.1 | — |
| NGINX Plus 37.0.x | fixed | 37.0.5.1 | — |
| NGINX Plus R33 to R36 (4 lines) | no fix yet | move to 37.0.5.1+ (newer branch) | restrict network access to it |
| NGINX Open Source 1.31.x | fixed | 1.31.7 | — |
| NGINX Open Source 1.30.x | fixed | 1.30.6 | — |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-97205") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://my.f5.com/manage/s/article/K000162608 https://nvd.nist.gov/vuln/detail/CVE-2026-97205
https://pwned.coffee/i/ngx-http-core-module-memory-corruption-cve-2026-97205

Timeline

27 Oct 2026, 08:17 UTC
Fix status: unknown → partial fix.
27 Oct 2026
First reported.

Receipt

Exploitation: No known exploitation
Fix by release line: Product Affected Fixed in Source
NGINX Plus 37.1.0 to before 37.1.0.1 37.1.0.1 CVE record (CNA) checked 27 Oct
NGINX Plus 37.0.0 to before 37.0.5.1 37.0.5.1 CVE record (CNA) checked 27 Oct
NGINX Plus R36 to now no fix on 36.x yet; move to 37.0.5.1+ (newer branch) CVE record (CNA) checked 27 Oct
NGINX Plus R35 to now no fix on 35.x yet; move to 37.0.5.1+ (newer branch) CVE record (CNA) checked 27 Oct
NGINX Plus R34 to now no fix on 34.x yet; move to 37.0.5.1+ (newer branch) CVE record (CNA) checked 27 Oct
NGINX Plus R33 to now no fix on 33.x yet; move to 37.0.5.1+ (newer branch) CVE record (CNA) checked 27 Oct
NGINX Open Source 1.31.0 to before 1.31.7 1.31.7 CVE record (CNA) checked 27 Oct
NGINX Open Source 1.30.0 to before 1.30.6 1.30.6 CVE record (CNA) checked 27 Oct
Score: CVSS 8.1 (high). CVSS 3.1 8.1 (CNA f5) for CVE-2026-97205
Last checked: 27 Oct 2026, 10:17 UTC

Product	Affected	Fixed in	Source
NGINX Plus	37.1.0 to before 37.1.0.1	37.1.0.1	CVE record (CNA) checked 27 Oct
NGINX Plus	37.0.0 to before 37.0.5.1	37.0.5.1	CVE record (CNA) checked 27 Oct
NGINX Plus	R36 to now	no fix on 36.x yet; move to 37.0.5.1+ (newer branch)	CVE record (CNA) checked 27 Oct
NGINX Plus	R35 to now	no fix on 35.x yet; move to 37.0.5.1+ (newer branch)	CVE record (CNA) checked 27 Oct
NGINX Plus	R34 to now	no fix on 34.x yet; move to 37.0.5.1+ (newer branch)	CVE record (CNA) checked 27 Oct
NGINX Plus	R33 to now	no fix on 33.x yet; move to 37.0.5.1+ (newer branch)	CVE record (CNA) checked 27 Oct
NGINX Open Source	1.31.0 to before 1.31.7	1.31.7	CVE record (CNA) checked 27 Oct
NGINX Open Source	1.30.0 to before 1.30.6	1.30.6	CVE record (CNA) checked 27 Oct

Sources: KEV – CVE record ✓ Vendor ✓

Sources

Wrong fix version, or a source we missed? Send it back to chef@pwned.coffee with the source, and we'll correct it here.

Totalone hot coffee