Use-after-free in NGINX Plus and NGINX Open Source - CVE-2026-56434

Vulnerability identifier: #VU137845

CSH Severity: Medium

CVSS v4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-56434

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service or modify memory contents.

The vulnerability exists due to use-after-free in the ngx_http_ssi_module module when processing responses from an upstream server with SSI enabled, proxy_pass configured, and proxy_buffering disabled. A remote attacker can control responses from an upstream server to cause a denial of service or modify memory contents.

Exploitation requires man-in-the-middle ability over upstream server responses. This is a data plane issue only.

NGINX Plus
NGINX Open Source
Debian Linux
Gentoo Linux
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
openEuler
Ubuntu
Anolis OS
Fedora
nginx-mod-js-challenge
nginx-mod-vts
nginx-mod-fancyindex
nginx-mod-headers-more
nginx-mod-brotli
nginx-mod-modsecurity
nginx-mod-naxsi
nginx (Ubuntu package)
nginx-help
nginx-filesystem
nginx-all-modules
nginx-mod-stream
nginx-mod-mail
nginx-mod-http-xslt-filter
nginx-mod-http-perl
nginx-mod-http-image-filter
nginx-mod-devel
nginx-debugsource
nginx-debuginfo
nginx
nginx (Debian package)
nginx (Red Hat package)
nginx-doc
nginx-core
www-servers/nginx

Install security update from vendor's website.

NGINX Plus - addressed in versions R36 P7, 37.0.3.1
NGINX Open Source - addressed in versions 1.30.4, 1.31.3
nginx-mod-js-challenge - update to 0^20230517.gitda6852d-11.fc45
nginx-mod-vts - update to 0.2.4-13.fc45
nginx-mod-fancyindex - update to 0.6.0-8.fc45
nginx-mod-headers-more - update to 0.40-3.fc45
nginx-mod-brotli - update to 1.0.0~rc-13.fc45
nginx-mod-modsecurity - update to 1.0.4-16.fc45
nginx-mod-naxsi - update to 1.6-21.fc45
nginx (Ubuntu package) - addressed in versions 1.18.0-6ubuntu14.17, 1.18.0-6ubuntu14.18, 1.18.0-6ubuntu14.19, 1.18.0-6ubuntu14.20, 1.18.0-6ubuntu14.21, 1.24.0-2ubuntu7.14, 1.24.0-2ubuntu7.15, 1.24.0-2ubuntu7.16, 1.24.0-2ubuntu7.17, 1.24.0-2ubuntu7.18, 1.28.3-2ubuntu1.7, 1.28.3-2ubuntu1.8, 1.28.3-2ubuntu1.9, 1.28.3-2ubuntu1.10, 1.28.3-2ubuntu1.11
nginx-help - update to 1.21.5-19
nginx-filesystem - update to 1.21.5-19
nginx-all-modules - update to 1.21.5-19
nginx-mod-stream - update to 1.21.5-19
nginx-mod-mail - update to 1.21.5-19
nginx-mod-http-xslt-filter - update to 1.21.5-19
nginx-mod-http-perl - update to 1.21.5-19
nginx-mod-http-image-filter - update to 1.21.5-19
nginx-mod-devel - update to 1.21.5-19
nginx-debugsource - update to 1.21.5-19
nginx-debuginfo - update to 1.21.5-19
nginx - update to 1.21.5-19
nginx (Debian package) - update to 1.26.3-3+deb13u8
nginx (Red Hat package) - update to 1.26.3-6.el10_2.6
nginx-doc - update to 1.30.4-1
nginx - update to 1.30.4-1
nginx-core - update to 1.30.4-1
nginx-mod-devel - update to 1.30.4-1
nginx-mod-http-image-filter - update to 1.30.4-1
nginx-mod-http-perl - update to 1.30.4-1
nginx-mod-http-xslt-filter - update to 1.30.4-1
nginx-mod-mail - update to 1.30.4-1
nginx-mod-stream - update to 1.30.4-1
nginx-all-modules - update to 1.30.4-1
nginx-filesystem - update to 1.30.4-1
nginx - update to 1.30.4-1.fc45
www-servers/nginx - update to 1.31.3-r1

• https://my.f5.com/manage/s/article/K000162098

• Multiple vulnerabilities in NGINX Open Source
• Ubuntu update for nginx
• Ubuntu update for nginx
• Fedora 45 update for nginx, nginx-mod-brotli, nginx-mod-fancyindex, nginx-mod-headers-more, nginx-mod-js-challenge, nginx-mod-modsecurity, nginx-mod-naxsi, nginx-mod-vts
• Anolis OS update for nginx
• openEuler update for nginx
• Gentoo update for nginx
• Ubuntu update for nginx
• Ubuntu update for nginx
• Red Hat Enterprise Linux 8 update for the nginx:1.24 module
• Red Hat Enterprise Linux 10 update for nginx
• Red Hat Enterprise Linux 9 update for the nginx:1.24 module
• Debian update for nginx
• Ubuntu update for nginx