CVE-2026-56434 - Vulnerability Details

- NGINX ngx_http_ssi_module vulnerability

Description

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module. This vulnerability may exist when the Server-Side Includes (SSI), proxy_pass, and proxy_buffering off directives are configured. With this configuration, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to cause a use-after-free in the NGINX worker process. This issue may lead to limited modification of memory or a restart of the NGINX worker process.

Impact:
This vulnerability may allow remote attackers to have limited control to modify memory contents or restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Published: 2026-07-15

Score: 8.3 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The flaw resides in the ngx_http_ssi_module of NGINX Plus and Open Source and is a CWE‑416 use‑after‑free vulnerability, also involving an out‑of‑bounds read (CWE‑125). When the SSI directive is enabled together with proxy_pass and proxy_buffering off, an attacker who can act as a man‑in‑the‑middle on the upstream link may trigger a use‑after‑free in the worker process. The resulting corrupt memory may be limited, and the worker can terminate, leading to a denial of service for the affected site.

Affected Systems

F5’s NGINX Open Source and NGINX Plus distributions are affected. The advisory does not list specific product versions; administrators should examine the latest release notes for each edition to find the fix, noting that versions that have reached end‑of‑technical support are not evaluated.

Risk and Exploitability

The CVSS score of 8.3 indicates high severity, while the EPSS score of less than 1 % suggests a low probability of exploitation at present. The issue is not listed in the CISA KEV catalog. The vulnerability can be abused only when an unauthenticated attacker can tamper with upstream responses, making the attack surface larger in deployments that do not authenticate or encrypt upstream traffic.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

NGINX Plus

unknown

Version	Status	Constraints
`37.0.0.1`	affected	< 37.0.3.1
`R36`	affected	< R36 P7
`R33`	affected	< *

NGINX Open Source

unknown

Version	Status	Constraints
`1.31.2`	affected	< 1.31.3
`0.8.11`	affected	< 1.30.4

No data.

Vendor Product Confidence Versions

Nginx Open Source

100%

Version	Status	Scheme	Platform
`[1.31.2,1.31.3)`	affected	semver	—
`[0.8.11,1.30.4)`	affected	semver	—

Nginx Plus

100%

Version	Status	Scheme	Platform
`[37.0.0.1,37.0.3.1)`	affected	generic	—
`[R36,R36 P7)`	affected	generic	—
`[R33,*]`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Install the latest NGINX release that fixes the CWE‑416 use‑after‑free (and related CWE‑125 out‑of‑bounds read) vulnerability in the ngx_http_ssi_module.
If upgrading is not possible, disable the ngx_http_ssi_module or remove the proxy_pass and proxy_buffering off directives to eliminate the code path that triggers the CWE‑416 (and CWE‑125) flaw.
Use network segmentation or enforce TLS on upstream links so that adversaries cannot alter responses that could lead to a use‑after‑free (CWE‑416) or out‑of‑bounds read (CWE‑125) exploitation.

Generated by OpenCVE AI on August 3, 2026 at 03:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8563-1	nginx vulnerabilities

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0045.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://my.f5.com/manage/s/article/K000162098
https://nvd.nist.gov/vuln/detail/CVE-2026-56434
https://www.cve.org/CVERecord?id=CVE-2026-56434

History

Wed, 29 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125
References		https://nvd.nist.gov/vuln/detail/CVE-2026-56434 https://www.cve.org/CVERecord?id=CVE-2026-56434
Metrics	threat_severity `None`	threat_severity `Moderate`

Wed, 15 Jul 2026 20:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		F5 F5 nginx Open Source F5 nginx Plus
Vendors & Products		F5 F5 nginx Open Source F5 nginx Plus

Wed, 15 Jul 2026 18:30:00 +0000

Type	Values Removed	Values Added
Description	NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module. This vulnerability may exist when the Server-Side Includes (SSI), proxy_pass, and proxy_buffering off directives are configured. With this configuration, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to cause a heap buffer over-read in the NGINX worker process. This issue may lead to limited modification of memory or a restart of the NGINX worker process. Impact: This vulnerability may allow remote attackers to have limited control to modify memory contents or restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.	NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module. This vulnerability may exist when the Server-Side Includes (SSI), proxy_pass, and proxy_buffering off directives are configured. With this configuration, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to cause a use-after-free in the NGINX worker process. This issue may lead to limited modification of memory or a restart of the NGINX worker process. Impact: This vulnerability may allow remote attackers to have limited control to modify memory contents or restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Wed, 15 Jul 2026 16:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 15 Jul 2026 15:00:00 +0000

Type	Values Removed	Values Added
Description		NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module. This vulnerability may exist when the Server-Side Includes (SSI), proxy_pass, and proxy_buffering off directives are configured. With this configuration, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to cause a heap buffer over-read in the NGINX worker process. This issue may lead to limited modification of memory or a restart of the NGINX worker process. Impact: This vulnerability may allow remote attackers to have limited control to modify memory contents or restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Title		NGINX ngx_http_ssi_module vulnerability
Weaknesses		CWE-416
References		https://my.f5.com/manage/s/article/K000162098
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H'}` cvssV4_0 `{'score': 8.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N'}`

Subscriptions

F5 Nginx Open Source Nginx Plus

MITRE

Status: PUBLISHED

Assigner: f5

Published: 2026-07-15T14:33:46.142Z

Updated: 2026-07-15T18:10:54.402Z

Reserved: 2026-07-08T15:49:43.050Z

Link: CVE-2026-56434

Vulnrichment

Updated: 2026-07-15T15:38:17.945Z

NVD

No data.

Redhat

Severity : Moderate

Publid Date: 2026-07-15T14:33:46Z

Links: CVE-2026-56434 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-03T03:15:05Z

Weaknesses

CWE-125
Out-of-bounds Read
CWE-416
Use After Free

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object