CVE-2026-97205

A flaw was found in NGINX. In certain configurations using asynchronous file I/O and SSI pages with include virtual commands, request processing can access freed memory in a worker process. A remote attacker may trigger memory corruption or a worker crash. Arbitrary code execution may be possible if ASLR is disabled or bypassed.

This vulnerability is rated as Important severity because an unauthenticated remote attacker could trigger memory corruption and worker crashes, potentially leading to arbitrary code execution. However, successful exploitation requires non-standard configurations where both asynchronous file I/O (aio) and Server Side Includes (ssi) processing are explicitly enabled. Furthermore, Red Hat Enterprise Linux systems enforce Address Space Layout Randomization (ASLR) by default, which substantially limits the feasibility of reliable code execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, based on your environment requirements, you can either disable asynchronous file I/O (AIO) or Server Side Includes (SSI).