CVE-2026-97205

NGINX is the software that serves your website or app to visitors, like the front door and receptionist of your online business. This flaw is like a trick note that, in one specific combination of settings, can jam the receptionist's desk — stopping service or, in the worst case, letting someone slip past the desk entirely and run their own commands.

This matters to you if you run NGINX or NGINX Plus as your web server. The risk only applies if your configuration has the "aio" (asynchronous file I/O) directive turned on and you serve Server Side Includes pages that use "include virtual" commands — if you don't use that combination, this specific issue does not reach you.

This is a high-severity flaw that has drawn sustained attention from security researchers, and no vendor fix delay is advisable given the potential for a crash or full compromise. No confirmed real-world attacks or public exploit code exist yet, but because the weakness is now publicly documented, businesses with the vulnerable configuration should patch before working exploit code appears rather than wait for proof of an attack.

Audit your nginx.conf (and included config files) for the "aio" directive combined with SSI blocks containing "include virtual". If found, this is a reachable configuration. Upgrade NGINX Plus to 37.1.0.1 or 37.0.5.1 (or the latest release), and open-source NGINX to 1.31.7 or 1.30.6. Review release notes for any breaking changes in the AIO/SSI handling before rolling out broadly, and test in staging first. If an immediate upgrade isn't possible, disable the "aio" directive or remove SSI "include virtual" usage as a workaround until patched. There is no CISA KEV listing and no due date, but given the HIGH CVSS score (8.1) and the possibility of memory corruption/code execution when ASLR protections are weak or absent, prioritize this over routine maintenance patches. Monitor for crash loops or unexpected worker process restarts as an indicator of exploitation attempts post-disclosure.

CVSS 3.1 score 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) — network-exploitable, no privileges or user interaction needed, but high attack complexity due to the specific AIO+SSI configuration requirement. Weakness type is use-after-free (CWE-416) in ngx_http_core_module, triggered by SSI "include virtual" processing while AIO is enabled, potentially leading to crash, memory corruption, or code execution if ASLR is disabled/bypassed. Not listed in CISA KEV; no public exploit code or confirmed in-the-wild exploitation as of now (press explicitly notes neither NGINX nor F5 reports attacks). Exploit maturity is theoretical/PoC-absent; predictive risk score is low and flat. Sustained press/security-researcher attention (roundup coverage) exists but should not be read as evidence of active exploitation.