CVE-2026-56434

A vulnerability in NGINX's ngx_http_ssi_module allows an unauthenticated MITM attacker to trigger a heap buffer over-read by manipulating upstream server responses. This requires SSI, proxy_pass, and proxy_buffering off to be configured, and can result in memory modification or a Denial of Service (DoS).

This Moderate severity vulnerability in NGINX affects configurations utilizing the ngx_http_ssi_module alongside proxy_pass and proxy_buffering off. Exploitation requires an unauthenticated man-in-the-middle attacker to control upstream server responses, leading to limited memory modification or a worker process restart. The specific combination of directives and an active MITM position limits the overall impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To prevent exploitation, avoid configuring NGINX with ngx_http_ssi_module when proxy_pass and proxy_buffering off are simultaneously active. If Server-Side Includes (SSI) are not essential, disable the ngx_http_ssi_module by removing or commenting out the ssi on; directive. Alternatively, ensure proxy_buffering is explicitly enabled (proxy_buffering on;) when proxy_pass is used with SSI. A reload or restart of the NGINX service is necessary for configuration changes to apply, which may cause a brief service interruption.