The vulnerability resides in the ngx_http_core_module of NGINX Open Source and NGINX Plus. When asynchronous file I/O is enabled, processing an SSI page that contains include virtual commands can trigger a use‑after‑free within the worker process. This can lead to memory corruption, a worker process crash, and, if Address Space Layout Randomization is disabled or can be bypassed, remote code execution.

The issue affects F5's NGINX Open Source and NGINX Plus deployments. No specific versions are listed in the advisory; therefore any installation of the affected products prior to an update that fixes the UAF is vulnerable. The flaw is limited to the data plane and does not provide control‑plane access. Software versions which have reached End of Technical Support (EoTS) are not evaluated.

The reported CVSS score of 9.2 indicates a high‑severity risk. The EPSS score of < 1% reflects a very low probability of exploitation, but if the conditions are met a remote attacker can cause a denial‑of‑service or, with ASLR disabled or bypassed, execute arbitrary code. The vulnerability is not currently listed in the CISA KEV catalog, and the requirement for specific configuration (AIO enabled and SSI pages) reduces the attack surface, though the potential damage remains severe.