F5 has identified three significant security vulnerabilities in NGINX Plus and Open Source, which can lead to remote, unauthenticated attackers crashing worker processes through crafted HTTP requests This article explores vulnerabilities nginx plus. . In some configurations, memory errors could potentially allow code execution, but F5 notes that this outcome necessitates Address Space Layout Randomization (ASLR) to be disabled or bypassed.

All three issues affect the NGINX data plane, which processes user traffic, rather than its control plane. F5 released the three advisories on October 14, 2026, and rated each issue as High at 8.1 under CVSS v3.1 and Critical at 9.2 under CVSS v4.0.

The use-after-free flaw in ngx_http_core_module, CVE-2026-97205, can be triggered when asynchronous file I/O, or AIO, is enabled and NGINX processes a Server Side Includes page containing an include virtual command. The unsafe condition can manifest when the root directive or access-log format uses map’s regex capture variables before the map output variable. F5 credits Matt Suiche of Tolmo and Mateusz Gierblinski for coordinated disclosure.

Turning off AIO can reduce performance for large static files or media streaming under heavy load, whereas disabling SSI stops NGINX from processing SSI tags. ZeroOwl previously reported three NGINX flaws involving heap overflows, memory disclosures, and use-after-free conditions, as well as an earlier group of bugs that could lead to code execution or denial of service.